{"record":{"id":"41f79fa9db404801","repo":"different-ai/openwork","slug":"den-diagnostics-origin-cannot-contain-credentials","errorCode":null,"errorMessage":"DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.","messagePattern":"DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"ee/apps/den-api/src/env.ts","lineNumber":406,"sourceCode":"\n  return url.toString()\n}\n\nfunction normalizeDiagnosticsOrigin(value: string | undefined, allowInsecureHttp: boolean) {\n  const configured = optionalString(value) ?? DEFAULT_DEN_DIAGNOSTICS_ORIGIN\n\n  let url: URL\n  try {\n    url = new URL(configured)\n  } catch {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.\")\n  }\n\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.\")\n  }\n  if (url.username || url.password || url.search || url.hash || (url.pathname !== \"/\" && url.pathname !== \"\")) {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.\")\n  }\n  if (url.protocol !== \"https:\" && !allowInsecureHttp) {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.\")\n  }\n  return url.origin\n}\n\nfunction normalizeOptionalHttpsOrigin(envName: string, value: string | undefined) {\n  const configured = optionalString(value)\n  if (!configured) {\n    return undefined\n  }\n\n  let url: URL\n  try {\n    url = new URL(configured)\n  } catch {\n    throw new Error(`${envName} must be an absolute https origin.`)","sourceCodeStart":388,"sourceCodeEnd":424,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/env.ts#L388-L424","documentation":"normalizeDiagnosticsOrigin enforces that the value is a bare origin: any embedded username/password, query string, hash, or non-root pathname is rejected, because the diagnostics endpoint is used as an origin only and extra components indicate a misconfiguration.","triggerScenarios":"DEN_DIAGNOSTICS_ORIGIN containing 'user:pass@', '?key=...', '#frag', or a path like 'https://host/diag/v1'.","commonSituations":"Pasting a full endpoint URL including a path or API key into an origin-only variable; accidentally including credentials to 'make it work'.","solutions":["Strip the path/query/fragment so only scheme://host[:port] remains, e.g. 'https://host/diag/v1?key=x' → 'https://host'","Move any credentials or query params into dedicated env vars or headers, never into the origin","If a path is genuinely needed, the app must support a base-URL var instead — this var intentionally accepts origins only"],"exampleFix":"// before\nDEN_DIAGNOSTICS_ORIGIN=https://diag.example.com/ingest?token=abc\n// after\nDEN_DIAGNOSTICS_ORIGIN=https://diag.example.com","handlingStrategy":"validation","validationCode":"function validateBareOrigin(v: string | undefined): void {\n  if (!v) return\n  const u = new URL(v)\n  if (u.username || u.password || u.search || u.hash || (u.pathname !== '/' && u.pathname !== '')) {\n    throw new Error('DEN_DIAGNOSTICS_ORIGIN must be a bare origin (no path/query/credentials)')\n  }\n}","typeGuard":"function isBareOrigin(v: string): boolean {\n  try {\n    const u = new URL(v)\n    return !u.username && !u.password && !u.search && !u.hash && (u.pathname === '/' || u.pathname === '')\n  } catch { return false }\n}","tryCatchPattern":"try {\n  bootServer(env)\n} catch (e) {\n  if (String((e as Error).message).includes('DEN_DIAGNOSTICS_ORIGIN cannot contain')) {\n    console.error('Use only scheme://host[:port]; move path/credentials elsewhere')\n    process.exit(1)\n  }\n  throw e\n}","preventionTips":["Strip paths and query strings from endpoint URLs before assigning to origin vars","Never embed credentials in URLs; use dedicated secret env vars","Keep a config lint that rejects URL components beyond host/port in *_ORIGIN vars"],"tags":["configuration","env","startup"],"backgroundTag":"invalid-env-var","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}