{"record":{"id":"2cfdcc1772a4557c","repo":"different-ai/openwork","slug":"envname-must-be-an-absolute-https-origin","errorCode":null,"errorMessage":"${envName} must be an absolute https origin.","messagePattern":"(.+?) must be an absolute https origin\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"ee/apps/den-api/src/env.ts","lineNumber":424,"sourceCode":"    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.\")\n  }\n  if (url.protocol !== \"https:\" && !allowInsecureHttp) {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.\")\n  }\n  return url.origin\n}\n\nfunction normalizeOptionalHttpsOrigin(envName: string, value: string | undefined) {\n  const configured = optionalString(value)\n  if (!configured) {\n    return undefined\n  }\n\n  let url: URL\n  try {\n    url = new URL(configured)\n  } catch {\n    throw new Error(`${envName} must be an absolute https origin.`)\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(`${envName} must be an absolute https origin.`)\n  }\n  if (url.username || url.password || url.search || url.hash || (url.pathname !== \"/\" && url.pathname !== \"\")) {\n    throw new Error(`${envName} cannot contain credentials, a path, a query string, or a fragment.`)\n  }\n\n  return url.origin\n}\n\nfunction normalizeAbsoluteUrlCsv(envName: string, value: string | undefined) {\n  const entries = splitCsv(value)\n  const invalidEntries: string[] = []\n\n  for (const entry of entries) {\n    try {","sourceCodeStart":406,"sourceCodeEnd":442,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/env.ts#L406-L442","documentation":"normalizeOptionalHttpsOrigin validates optional https-only env vars (identified by envName, e.g. a marketplace/Den URL). If new URL(configured) throws — value present but not an absolute URL — it throws '<envName> must be an absolute https origin.' The variable is optional, but once set it must be a valid absolute https origin.","triggerScenarios":"Setting an https-only env var to 'example.com' (no scheme), an empty-but-truthy string, or garbage like 'localhost' without scheme.","commonSituations":"Typos in the value, missing scheme when documenting example configs, shell quoting leaving stray characters.","solutions":["Provide a full absolute https origin, e.g. 'https://den.example.com', or unset the variable to use the default","Check for stray quotes/whitespace in the deployed env file","Validate locally with `node -e \"new URL(process.env.VAR)\"` before deploying"],"exampleFix":"// before\nDEN_MARKETPLACE_ORIGIN=market.internal\n// after\nDEN_MARKETPLACE_ORIGIN=https://market.internal","handlingStrategy":"validation","validationCode":"function validateHttpsOriginVar(name: string, v: string | undefined): void {\n  if (!v) return\n  try {\n    const u = new URL(v)\n    if (u.protocol !== 'https:') throw new Error(`${name} must be an absolute https origin.`)\n  } catch (e) {\n    throw new Error(`${name} must be an absolute https origin.`)\n  }\n}","typeGuard":"function isValidHttpsOrigin(v: string): boolean {\n  try { return new URL(v).protocol === 'https:' } catch { return false }\n}","tryCatchPattern":"try {\n  bootServer(env)\n} catch (e) {\n  if (String((e as Error).message).endsWith('must be an absolute https origin.')) {\n    console.error('Set the variable to a full https://host URL or unset it to use the default')\n    process.exit(1)\n  }\n  throw e\n}","preventionTips":["Provide full https:// URLs in config examples","Validate all https-only env vars with new URL checks in deploy scripts","Leave optional vars unset rather than partially filled"],"tags":["configuration","env","startup"],"backgroundTag":"invalid-env-var","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}