Mintplex-Labs/anything-llm · error

Invalid request.

Error message

Invalid request.

What it means

Origin hardening check inside canRespond. EmbedConfig.parseAllowedHosts returns null when the embed has no allowlist_domains at all; normally that means allow-any-origin, but when the environment variable EMBED_REQUIRE_ALLOWLIST is present, 'no allowlist' is treated as deny-all and the request gets HTTP 401 with a generic abort payload ('Invalid request.'). This prevents an embed from being queried cross-origin until its owner sets allowed domains.

Source

Thrown at server/utils/middleware/embedMiddleware.js:75

        sources: [],
        close: true,
        error:
          "This chat has been disabled by the administrator - try again later.",
      });
      return;
    }

    // Check if requester hostname is in the valid allowlist of domains.
    const host = request.headers.origin ?? "";
    const allowedHosts = EmbedConfig.parseAllowedHosts(embed);

    // Optional hardening for when an embed with no allowlist is created.
    // This would mean the embed will accept requests from ANY origin (parseAllowedHosts returns
    // null). When EMBED_REQUIRE_ALLOWLIST is enabled, treat "no allowlist" as
    // deny-all instead of allow-all, so an embed cannot be queried cross-origin
    // until its owner explicitly sets the allowed domains.
    if (allowedHosts === null && "EMBED_REQUIRE_ALLOWLIST" in process.env) {
      response.status(401).json({
        id: uuidv4(),
        type: "abort",
        textResponse: null,
        sources: [],
        close: true,
        error: "Invalid request.",
      });
      return;
    }

    if (allowedHosts !== null && !allowedHosts.includes(host)) {
      response.status(401).json({
        id: uuidv4(),
        type: "abort",
        textResponse: null,
        sources: [],
        close: true,
        error: "Invalid request.",

View on GitHub (pinned to 3aec848f28)

Solutions

  1. Add allowed origins to the embed config (comma-separated origin list, e.g. https://my.site) in the admin UI
  2. Or remove EMBED_REQUIRE_ALLOWLIST from .env if allow-any-origin is acceptable, then restart
  3. After either change, reload the page so the widget starts a fresh request

Example fix

# before: embed created with no allowlist + hardening on
EMBED_REQUIRE_ALLOWLIST=true   # -> every request 401 'Invalid request.'

# after: configure the embed's allowed domains to ["https://my.site"]
# (or unset the env var entirely)
Defensive patterns

Strategy: validation

Validate before calling

// before embedding: ensure the config has domains when hardening is on
const requiresAllowlist = "EMBED_REQUIRE_ALLOWLIST" in process.env;
if (requiresAllowlist && !embed.allowlist_domains)
  throw new Error('Set allowlist domains on the embed or unset EMBED_REQUIRE_ALLOWLIST');

Type guard

const embedWillAcceptOrigins = (embed) =>
  !("EMBED_REQUIRE_ALLOWLIST" in process.env) || Boolean(embed?.allowlist_domains);

Try / catch

if (res.status === 401) {
  const data = await res.json();
  if (data.type === 'abort') checkAllowlistConfig(); // 401 here is config, not credentials
}

Prevention

When it happens

Trigger: EMBED_REQUIRE_ALLOWLIST is set in the environment AND the embed config's allowlist_domains is empty/null; every message to that embed gets 401 regardless of origin.

Common situations: Operator enables the hardening flag globally and forgets that pre-existing embeds created without an allowlist now deny everyone; local testing with a fresh embed before configuring domains.

Related errors

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/753fc3ae4276e954. Report an issue: GitHub.