{"record":{"id":"60b32f01be159deb","repo":"dgraph-io/dgraph","slug":"incorrect-format-for-specifying-dgraph-allow-origi","errorCode":null,"errorMessage":"incorrect format for specifying Dgraph.Allow-Origin found for comment: `%s`, it should be `# Dgraph.Allow-Origin \"http://example.com\"`","messagePattern":"incorrect format for specifying Dgraph\\.Allow-Origin found for comment: `(.+?)`, it should be `# Dgraph\\.Allow-Origin \"http://example\\.com\"`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"graphql/schema/schemagen.go","lineNumber":222,"sourceCode":"\tvar err error\n\tfor scanner.Scan() {\n\t\ttext := strings.TrimSpace(scanner.Text())\n\n\t\tif strings.HasPrefix(text, \"#\") {\n\t\t\theader := strings.TrimSpace(text[1:])\n\t\t\tif strings.HasPrefix(header, \"Dgraph.Authorization\") {\n\t\t\t\tif authSecret != \"\" {\n\t\t\t\t\treturn nil, errors.Errorf(\"Dgraph.Authorization should be only be specified once in \"+\n\t\t\t\t\t\t\"a schema, found second mention: %v\", text)\n\t\t\t\t}\n\t\t\t\tauthSecret = text\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif strings.HasPrefix(header, \"Dgraph.Allow-Origin\") {\n\t\t\t\tparts := strings.Fields(text)\n\t\t\t\tif len(parts) != 3 {\n\t\t\t\t\treturn nil, errors.Errorf(\"incorrect format for specifying Dgraph.Allow-Origin\"+\n\t\t\t\t\t\t\" found for comment: `%s`, it should be `# Dgraph.\"+\n\t\t\t\t\t\t\"Allow-Origin \\\"http://example.com\\\"`\", text)\n\t\t\t\t}\n\t\t\t\tvar allowedOrigin string\n\t\t\t\tif err = json.Unmarshal([]byte(parts[2]), &allowedOrigin); err != nil {\n\t\t\t\t\treturn nil, errors.Errorf(\"incorrect format for specifying Dgraph.Allow-Origin\"+\n\t\t\t\t\t\t\" found for comment: `%s`, it should be `# Dgraph.\"+\n\t\t\t\t\t\t\"Allow-Origin \\\"http://example.com\\\"`\", text)\n\t\t\t\t}\n\t\t\t\tschMetaInfo.allowedCorsOrigins[allowedOrigin] = true\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif !strings.HasPrefix(header, \"Dgraph.Secret\") {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tparts := strings.Fields(text)\n\t\t\tconst doubleQuotesCode = 34","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/graphql/schema/schemagen.go#L204-L240","documentation":"The `# Dgraph.Allow-Origin` schema comment must have exactly three whitespace-separated fields: the comment marker, the directive name, and a JSON-quoted origin. If the line splits into a number of fields other than 3, parseMetaInfo returns this error describing the correct format.","triggerScenarios":"Calling NewHandler/schema generation with a comment like `# Dgraph.Allow-Origin *` or `# Dgraph.Allow-Origin` or an origin plus extra tokens — anything where strings.Fields(text) does not yield exactly 3 parts.","commonSituations":"Writing the origin without quotes (`# Dgraph.Allow-Origin http://example.com`); using `*` unquoted; trailing comments on the same line; extra whitespace tokens.","solutions":["Quote the origin as a JSON string: `# Dgraph.Allow-Origin \"http://example.com\"`.","Remove any extra tokens on the line (no trailing comments).","For all origins use the JSON-quoted wildcard: `# Dgraph.Allow-Origin \"*\"`."],"exampleFix":"// before\n# Dgraph.Allow-Origin http://example.com\n// after\n# Dgraph.Allow-Origin \"http://example.com\"","handlingStrategy":"validation","validationCode":"// verify format before submitting schema\nfor _, line := range strings.Split(schemaText, \"\\n\") {\n    t := strings.TrimSpace(line)\n    if strings.HasPrefix(t, \"# Dgraph.Allow-Origin\") {\n        parts := strings.Fields(t)\n        if len(parts) != 3 {\n            return fmt.Errorf(\"bad Allow-Origin line (need 3 fields): %s\", t)\n        }\n        var origin string\n        if err := json.Unmarshal([]byte(parts[2]), &origin); err != nil {\n            return fmt.Errorf(\"origin must be a JSON string: %s\", t)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"h, err := schema.NewHandler(...)\nif err != nil {\n    if strings.Contains(err.Error(), \"Dgraph.Allow-Origin\") {\n        return fmt.Errorf(\"fix # Dgraph.Allow-Origin comment format: %w\", err)\n    }\n    return err\n}","preventionTips":["Always double-quote the origin: # Dgraph.Allow-Origin \"http://example.com\".","No trailing text after the quoted origin.","Lint Dgraph meta comments in CI with the same field-count check.","Keep CORS origins in one managed schema section."],"tags":["dgraph","graphql","cors","schema"],"backgroundTag":"invalid-schema-comment-format","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}