{"record":{"id":"3f3752476c7d0fd7","repo":"nats-io/nats-server","slug":"unable-to-parse-allowed-origin-q-host-is-require","errorCode":null,"errorMessage":"unable to parse allowed origin %q: host is required","messagePattern":"unable to parse allowed origin %q: host is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/websocket.go","lineNumber":1146,"sourceCode":"\t}\n\tif !wsAllowedFIPS() {\n\t\treturn fmt.Errorf(\"websocket: cannot be used in FIPS-140 mode when built with this Go version, use Go 1.26 or later\")\n\t}\n\t// Enforce TLS... unless NoTLS is set to true.\n\tif wo.TLSConfig == nil && !wo.NoTLS {\n\t\treturn errors.New(\"websocket requires TLS configuration\")\n\t}\n\t// Make sure that allowed origins, if specified, can be parsed.\n\tfor _, ao := range wo.AllowedOrigins {\n\t\tu, err := url.ParseRequestURI(ao)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to parse allowed origin: %v\", err)\n\t\t}\n\t\tif u.Scheme != \"http\" && u.Scheme != \"https\" {\n\t\t\treturn fmt.Errorf(\"unable to parse allowed origin %q: allowed origins must be absolute URLs with http or https scheme\", ao)\n\t\t}\n\t\tif u.Host == _EMPTY_ {\n\t\t\treturn fmt.Errorf(\"unable to parse allowed origin %q: host is required\", ao)\n\t\t}\n\t\tif _, _, err := wsGetHostAndPort(u.Scheme == \"https\", u.Host); err != nil {\n\t\t\treturn fmt.Errorf(\"unable to parse allowed origin: %v\", err)\n\t\t}\n\t}\n\t// If there is a NoAuthUser, we need to have Users defined and\n\t// the user to be present.\n\tif wo.NoAuthUser != _EMPTY_ {\n\t\tif err := validateNoAuthUser(o, wo.NoAuthUser); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\t// Token/Username not possible if there are users/nkeys\n\tif len(o.Users) > 0 || len(o.Nkeys) > 0 {\n\t\tif wo.Username != _EMPTY_ {\n\t\t\treturn fmt.Errorf(\"websocket authentication username not compatible with presence of users/nkeys\")\n\t\t}\n\t\tif wo.Token != _EMPTY_ {","sourceCodeStart":1128,"sourceCodeEnd":1164,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/websocket.go#L1128-L1164","documentation":"Returned by validateWebsocketOptions() when an allowed_origins entry parses as an absolute http(s) URL but has an empty host component (e.g. 'https:///path'). Without a host the origin cannot be meaningfully compared against the Origin header of incoming websocket requests, so startup is aborted.","triggerScenarios":"Thrown at server/websocket.go:1146 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add the hostname to the origin value, e.g. https://example.com/path","Remove entries that contain no host portion","Verify the config was not mangled (missing host after scheme)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}