{"record":{"id":"753fc3ae4276e954","repo":"Mintplex-Labs/anything-llm","slug":"invalid-request","errorCode":null,"errorMessage":"Invalid request.","messagePattern":"Invalid request\\.","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"server/utils/middleware/embedMiddleware.js","lineNumber":75,"sourceCode":"        sources: [],\n        close: true,\n        error:\n          \"This chat has been disabled by the administrator - try again later.\",\n      });\n      return;\n    }\n\n    // Check if requester hostname is in the valid allowlist of domains.\n    const host = request.headers.origin ?? \"\";\n    const allowedHosts = EmbedConfig.parseAllowedHosts(embed);\n\n    // Optional hardening for when an embed with no allowlist is created.\n    // This would mean the embed will accept requests from ANY origin (parseAllowedHosts returns\n    // null). When EMBED_REQUIRE_ALLOWLIST is enabled, treat \"no allowlist\" as\n    // deny-all instead of allow-all, so an embed cannot be queried cross-origin\n    // until its owner explicitly sets the allowed domains.\n    if (allowedHosts === null && \"EMBED_REQUIRE_ALLOWLIST\" in process.env) {\n      response.status(401).json({\n        id: uuidv4(),\n        type: \"abort\",\n        textResponse: null,\n        sources: [],\n        close: true,\n        error: \"Invalid request.\",\n      });\n      return;\n    }\n\n    if (allowedHosts !== null && !allowedHosts.includes(host)) {\n      response.status(401).json({\n        id: uuidv4(),\n        type: \"abort\",\n        textResponse: null,\n        sources: [],\n        close: true,\n        error: \"Invalid request.\",","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/utils/middleware/embedMiddleware.js#L57-L93","documentation":"Origin hardening check inside canRespond. EmbedConfig.parseAllowedHosts returns null when the embed has no allowlist_domains at all; normally that means allow-any-origin, but when the environment variable EMBED_REQUIRE_ALLOWLIST is present, 'no allowlist' is treated as deny-all and the request gets HTTP 401 with a generic abort payload ('Invalid request.'). This prevents an embed from being queried cross-origin until its owner sets allowed domains.","triggerScenarios":"EMBED_REQUIRE_ALLOWLIST is set in the environment AND the embed config's allowlist_domains is empty/null; every message to that embed gets 401 regardless of origin.","commonSituations":"Operator enables the hardening flag globally and forgets that pre-existing embeds created without an allowlist now deny everyone; local testing with a fresh embed before configuring domains.","solutions":["Add allowed origins to the embed config (comma-separated origin list, e.g. https://my.site) in the admin UI","Or remove EMBED_REQUIRE_ALLOWLIST from .env if allow-any-origin is acceptable, then restart","After either change, reload the page so the widget starts a fresh request"],"exampleFix":"# before: embed created with no allowlist + hardening on\nEMBED_REQUIRE_ALLOWLIST=true   # -> every request 401 'Invalid request.'\n\n# after: configure the embed's allowed domains to [\"https://my.site\"]\n# (or unset the env var entirely)","handlingStrategy":"validation","validationCode":"// before embedding: ensure the config has domains when hardening is on\nconst requiresAllowlist = \"EMBED_REQUIRE_ALLOWLIST\" in process.env;\nif (requiresAllowlist && !embed.allowlist_domains)\n  throw new Error('Set allowlist domains on the embed or unset EMBED_REQUIRE_ALLOWLIST');","typeGuard":"const embedWillAcceptOrigins = (embed) =>\n  !(\"EMBED_REQUIRE_ALLOWLIST\" in process.env) || Boolean(embed?.allowlist_domains);","tryCatchPattern":"if (res.status === 401) {\n  const data = await res.json();\n  if (data.type === 'abort') checkAllowlistConfig(); // 401 here is config, not credentials\n}","preventionTips":["When enabling EMBED_REQUIRE_ALLOWLIST, audit existing embeds for empty allowlists first","Configure allowlist domains at embed creation time","Restart and smoke-test one message after env changes"],"tags":["embed","cors","allowlist","environment-variable","http-401"],"backgroundTag":"origin-not-allowlisted","analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}