{"record":{"id":"88e708f1c9a79bfa","repo":"transloadit/uppy","slug":"option-corsorigins-cannot-be-to-disable-secur","errorCode":null,"errorMessage":"Option corsOrigins cannot be \"*\". To disable security, pass true","messagePattern":"Option corsOrigins cannot be \"\\*\"\\. To disable security, pass true","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"packages/@uppy/companion/src/config/companion.ts","lineNumber":148,"sourceCode":"  if (uploadUrls == null || uploadUrls.length === 0) {\n    if (process.env['NODE_ENV'] === 'production') {\n      throw new Error('uploadUrls is required')\n    }\n    logger.error(\n      'Running without uploadUrls is a security risk and Companion will refuse to start up when running in production (NODE_ENV=production)',\n      'startup.uploadUrls',\n    )\n  }\n\n  const { corsOrigins } = companionOptions\n  if (corsOrigins == null) {\n    throw new TypeError(\n      'Option corsOrigins is required. To disable security, pass true',\n    )\n  }\n\n  if (corsOrigins === '*') {\n    throw new TypeError(\n      'Option corsOrigins cannot be \"*\". To disable security, pass true',\n    )\n  }\n}\n","sourceCodeStart":130,"sourceCodeEnd":153,"githubUrl":"https://github.com/transloadit/uppy/blob/5d4dedd02a1ac0ae022c75c54aca76558f88e256/packages/@uppy/companion/src/config/companion.ts#L130-L153","documentation":"corsOrigins: '*' is explicitly rejected because wildcard CORS is insecure for a server that handles OAuth tokens and file proxying. Companion asks you to pass true instead if you truly want to disable origin restriction.","triggerScenarios":"Setting { corsOrigins: '*' } in companionOptions.","commonSituations":"Copy-pasting CORS configs from browser-era examples; attempting to allow all origins during local testing or behind a proxy.","solutions":["Replace '*' with the explicit list of allowed origins","If you deliberately want no origin check (e.g. internal tooling), pass corsOrigins: true"],"exampleFix":"// before\ncorsOrigins: '*'\n\n// after\ncorsOrigins: ['https://app.example.com', 'https://staging.example.com']","handlingStrategy":"validation","validationCode":"if (companionOptions.corsOrigins === '*') companionOptions.corsOrigins = true // if disabling security is intended","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Never write corsOrigins: '*'","Use an explicit origin array or boolean true"],"tags":["companion","configuration","cors","security"],"backgroundTag":"invalid-configuration-value","analyzedSha":"5d4dedd02a1ac0ae022c75c54aca76558f88e256","analyzedAt":"2026-08-28T12:18:41.267Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}