{"record":{"id":"3913117c7ab467a4","repo":"vllm-project/vllm","slug":"invalid-allowed-origins-value-origin-e","errorCode":null,"errorMessage":"invalid --allowed-origins value {origin:?}: {e}","messagePattern":"invalid --allowed-origins value (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"rust/src/server/src/config.rs","lineNumber":88,"sourceCode":"impl Default for CorsConfig {\n    fn default() -> Self {\n        Self {\n            allow_origins: vec![\"*\".to_string()],\n            allow_methods: vec![\"*\".to_string()],\n            allow_headers: vec![\"*\".to_string()],\n            allow_credentials: false,\n        }\n    }\n}\n\nimpl CorsConfig {\n    /// Validate that non-wildcard values parse into HTTP types, so the CORS\n    /// layer can be built infallibly after startup validation has run.\n    pub fn validate(&self) -> Result<()> {\n        for origin in &self.allow_origins {\n            if origin != \"*\" {\n                origin.parse::<HeaderValue>().map_err(|e| {\n                    anyhow::anyhow!(\"invalid --allowed-origins value {origin:?}: {e}\")\n                })?;\n            }\n        }\n        for method in &self.allow_methods {\n            if method != \"*\" {\n                method.parse::<Method>().map_err(|e| {\n                    anyhow::anyhow!(\"invalid --allowed-methods value {method:?}: {e}\")\n                })?;\n            }\n        }\n        for header in &self.allow_headers {\n            if header != \"*\" {\n                header.parse::<HeaderName>().map_err(|e| {\n                    anyhow::anyhow!(\"invalid --allowed-headers value {header:?}: {e}\")\n                })?;\n            }\n        }\n        Ok(())","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/vllm-project/vllm/blob/c794754062d49a8fdb63ab3c5215b488b865030c/rust/src/server/src/config.rs#L70-L106","documentation":"This anyhow error is produced by CorsConfig::validate() when a non-wildcard --allowed-origins value fails to parse as an http::HeaderValue (e.g. contains illegal characters like spaces, control bytes, or non-ASCII). Validation runs at startup so the CORS layer can be built infallibly afterwards. Wildcard \"*\" is exempt from parsing.","triggerScenarios":"Passing --allowed-origins with an invalid header value: origins containing whitespace, quotes, backslashes, or raw non-ASCII bytes; shell-quoting mistakes that leave stray characters in the value.","commonSituations":"Copy-pasted origins with trailing spaces or smart quotes; unquoted CLI args where the shell splits/mangles the URL; origins with unicode hostnames not in punycode; multiple origins passed as one comma-separated string where the config expects separate values.","solutions":["Correct the origin to a clean ASCII URL: https://example.com (no trailing slash issues, no spaces, scheme+host only)","Quote CLI arguments properly and pass each origin as its own value if the option is multi-value","Use punycode (xn--) for IDN hostnames","Use \"*\" only when wildcard CORS is actually intended"],"exampleFix":"# before\n--allowed-origins 'https://example.com ' --allowed-origins https://api.example.com,https://web.example.com\n\n# after\n--allowed-origins https://example.com --allowed-origins https://api.example.com --allowed-origins https://web.example.com","handlingStrategy":"validation","validationCode":"// Mirror of the server-side check, run before config submission\nfor o in &allowed_origins {\n    if o != \"*\" {\n        o.parse::<http::HeaderValue>().map_err(|e| format!(\"invalid origin {o:?}: {e}\"))?;\n    }\n}","typeGuard":"fn valid_origin(o: &str) -> bool {\n    o == \"*\" || o.parse::<http::HeaderValue>().is_ok()\n}","tryCatchPattern":null,"preventionTips":["Write origins as plain ASCII scheme://host with no spaces, quotes, or trailing punctuation","Quote CLI args and pass repeated flags per origin instead of comma-joining","Use punycode for IDN domains; reserve \"*\" for deliberate wildcard configs"],"tags":["cors","configuration","http-header","server","rust"],"backgroundTag":null,"analyzedSha":"c794754062d49a8fdb63ab3c5215b488b865030c","analyzedAt":"2026-08-14T21:17:39.825Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}