{"record":{"id":"a81171521cfb48da","repo":"fullstackhero/dotnet-starter-kit","slug":"origin-url-is-not-configured","errorCode":null,"errorMessage":"Origin URL is not configured.","messagePattern":"Origin URL is not configured\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Modules/Identity/Modules.Identity/Features/v1/Users/ForgotPassword/ForgotPasswordCommandHandler.cs","lineNumber":27,"sourceCode":"public sealed class ForgotPasswordCommandHandler : ICommandHandler<ForgotPasswordCommand, string>\n{\n    private readonly IUserService _userService;\n    private readonly IOptions<OriginOptions> _originOptions;\n\n    public ForgotPasswordCommandHandler(IUserService userService, IOptions<OriginOptions> originOptions)\n    {\n        _userService = userService;\n        _originOptions = originOptions;\n    }\n\n    public async ValueTask<string> Handle(ForgotPasswordCommand command, CancellationToken cancellationToken)\n    {\n        ArgumentNullException.ThrowIfNull(command);\n\n        var origin = _originOptions.Value?.OriginUrl?.ToString();\n        if (string.IsNullOrWhiteSpace(origin))\n        {\n            throw new InvalidOperationException(\"Origin URL is not configured.\");\n        }\n\n        await _userService.ForgotPasswordAsync(command.Email, origin, cancellationToken).ConfigureAwait(false);\n\n        return \"Password reset email sent.\";\n    }\n}","sourceCodeStart":9,"sourceCodeEnd":34,"githubUrl":"https://github.com/fullstackhero/dotnet-starter-kit/blob/3f2959e683e9f83f13e55e1678c9119f63c7e8e5/src/Modules/Identity/Modules.Identity/Features/v1/Users/ForgotPassword/ForgotPasswordCommandHandler.cs#L9-L34","documentation":"ForgotPasswordCommandHandler requires the app's configured OriginUrl (used to build the password-reset link embedded in the email). When the Origin options section is missing or OriginUrl is unset/blank, the handler deliberately fails fast with InvalidOperationException instead of sending an email with a null/relative link.","triggerScenarios":"Calling POST forgot-password when appsettings has no Origin section, the OriginUrl key is empty, or the strongly-typed options were never bound (e.g. services.Configure<OriginOptions> not registered or section name typo).","commonSituations":"Deploying to a fresh environment where only Database/ConnectionStrings were copied over; a config refactor renamed OriginUrl; running the API locally without the Origin appsettings block; Docker deployments missing the Origin__OriginUrl env var.","solutions":["Set OriginUrl in appsettings.json under the Origin section (e.g. \"Origin\": { \"Url\": \"https://your-host\" } per the options binding) or via env var Origin__Url.","Verify the options are bound at startup: services.Configure<OriginOptions>(config.GetSection(...)) exists in the Identity/API registration.","Confirm IOptions<OriginOptions>.Value.OriginUrl is a valid absolute URI; fix malformed URLs that fail to parse into Uri.","Add a startup validation (IValidateOptions or AddOptions().Validate...) so a missing origin is caught at boot, not on first forgot-password call."],"exampleFix":"// before (appsettings.json)\n{\n  \"Database\": { \"ConnectionString\": \"...\" }\n}\n// after\n{\n  \"Origin\": {\n    \"Url\": \"https://api.myapp.com\"\n  }\n}","handlingStrategy":"validation","validationCode":"var origin = originOptions.Value?.OriginUrl?.ToString();\nif (string.IsNullOrWhiteSpace(origin))\n    throw new InvalidOperationException(\"Origin URL is not configured (check Origin:Url in appsettings / Origin__Url env var).\");","typeGuard":"bool HasOrigin(OriginOptions? o) => Uri.TryCreate(o?.OriginUrl?.ToString(), UriKind.Absolute, out var u) && (u.Scheme is \"http\" or \"https\");","tryCatchPattern":"try { await mediator.Send(new ForgotPasswordCommand(email)); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"Origin URL is not configured\")) {\n    logger.LogError(ex, \"Origin not configured\");\n    return Problem(statusCode: 500, title: \"Server misconfiguration: origin URL missing\");\n}","preventionTips":["Keep an Origin:Url entry in every environment's appsettings.{env}.json.","Provide Origin__Url as an env var in Docker/K8s deployments.","Add startup options validation so misconfig fails fast at boot.","Document required config keys in deployment runbooks."],"tags":["configuration","identity","password-reset"],"backgroundTag":"missing-required-config-field","analyzedSha":"3f2959e683e9f83f13e55e1678c9119f63c7e8e5","analyzedAt":"2026-09-15T22:20:53.684Z","contentChangedAt":"2026-09-15T22:20:53.684Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}