{"record":{"id":"05ba89ac3a4c5696","repo":"joewalnes/websocketd","slug":"anyorigin-means-accept-any-origin-and-cannot-b","errorCode":null,"errorMessage":"--anyorigin means 'accept any origin' and cannot be combined with --sameorigin or --origin, which restrict it","messagePattern":"--anyorigin means 'accept any origin' and cannot be combined with --sameorigin or --origin, which restrict it","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config.go","lineNumber":163,"sourceCode":"}\n\n// validateBinaryPassStderr checks that --binary and --passstderr aren't both\n// set. Tagging binary chunks as JSON isn't implemented (--passstderr always\n// reads line by line), so combining the two would silently discard --binary\n// instead of behaving as either flag alone.\nfunc validateBinaryPassStderr(binary, passStderr bool) error {\n\tif binary && passStderr {\n\t\treturn fmt.Errorf(\"please only specify one of --binary and --passstderr\")\n\t}\n\treturn nil\n}\n\n// validateAnyOrigin checks that --anyorigin is not combined with an actual\n// origin policy. The flags say opposite things, and silently preferring one\n// would hide operator confusion.\nfunc validateAnyOrigin(anyOrigin, sameOrigin bool, allowOrigins []string) error {\n\tif anyOrigin && (sameOrigin || allowOrigins != nil) {\n\t\treturn fmt.Errorf(\"--anyorigin means 'accept any origin' and cannot be combined with --sameorigin or --origin, which restrict it\")\n\t}\n\treturn nil\n}\n\n// validateMaxFrameSize rejects negative --maxframesize values. The read\n// limit is only applied for positive values, so a negative value silently\n// meant \"unlimited\" — the one value an operator can pass that quietly\n// removes the DoS protection the flag exists for (issue #472).\nfunc validateMaxFrameSize(maxFrameSize int64) error {\n\tif maxFrameSize < 0 {\n\t\treturn fmt.Errorf(\"--maxframesize must not be negative; use 0 for unlimited\")\n\t}\n\treturn nil\n}\n\n// buildParentEnv constructs the filtered parent environment variable list.\nfunc buildParentEnv(passenv string) []string {\n\tenv := make([]string, 0)","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/joewalnes/websocketd/blob/7a8683dc7f9778dc615945aaed2a8dc77290227b/config.go#L145-L181","documentation":"validateAnyOrigin rejects --anyorigin combined with --sameorigin or --origin. --anyorigin means 'accept any origin', while the other flags restrict origins — the flags are contradictory and silently preferring one would hide operator confusion.","triggerScenarios":"Running websocketd with --anyorigin together with --sameorigin, or with one or more --origin=URL values (allowOrigins non-nil).","commonSituations":"Layering origin flags from multiple config sources (shell wrapper plus CLI); copying an example command line that already had --origin and appending --anyorigin to 'fix' CORS errors.","solutions":["Keep only --anyorigin if you truly want to accept all origins (insecure; avoid in production)","Remove --anyorigin and keep --sameorigin or the explicit --origin list to restrict origins","Audit wrapper scripts/env so origin policy comes from a single source"],"exampleFix":"// before\nwebsocketd --anyorigin --origin=http://example.com --port=8080 ./script.sh\n// after\nwebsocketd --origin=http://example.com --port=8080 ./script.sh","handlingStrategy":"validation","validationCode":"const originFlags = [args.includes('--anyorigin'), args.includes('--sameorigin'), args.filter(a=>a.startsWith('--origin=')).length > 0];\nif (originFlags.filter(Boolean).length > 1) throw new Error('use only one origin policy flag');","typeGuard":null,"tryCatchPattern":"try { startServer(args) } catch (e) { if (/--anyorigin.*cannot be combined/.test(e)) console.error('choose --anyorigin OR --sameorigin/--origin, not both'); throw e; }","preventionTips":["Define the origin policy in exactly one place (one flag set, one config source)","Prefer explicit --origin lists in production; reserve --anyorigin for local dev"],"tags":["cli","cors","origin-policy","config-validation"],"backgroundTag":"conflicting-cli-flags","analyzedSha":"7a8683dc7f9778dc615945aaed2a8dc77290227b","analyzedAt":"2026-09-03T13:52:22.309Z","contentChangedAt":"2026-09-03T13:52:22.309Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}