{"record":{"id":"be45f66f50100e6d","repo":"vllm-project/vllm","slug":"invalid-allowed-headers-value-header-e","errorCode":null,"errorMessage":"invalid --allowed-headers value {header:?}: {e}","messagePattern":"invalid --allowed-headers value (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"rust/src/server/src/config.rs","lineNumber":102,"sourceCode":"    pub fn validate(&self) -> Result<()> {\n        for origin in &self.allow_origins {\n            if origin != \"*\" {\n                origin.parse::<HeaderValue>().map_err(|e| {\n                    anyhow::anyhow!(\"invalid --allowed-origins value {origin:?}: {e}\")\n                })?;\n            }\n        }\n        for method in &self.allow_methods {\n            if method != \"*\" {\n                method.parse::<Method>().map_err(|e| {\n                    anyhow::anyhow!(\"invalid --allowed-methods value {method:?}: {e}\")\n                })?;\n            }\n        }\n        for header in &self.allow_headers {\n            if header != \"*\" {\n                header.parse::<HeaderName>().map_err(|e| {\n                    anyhow::anyhow!(\"invalid --allowed-headers value {header:?}: {e}\")\n                })?;\n            }\n        }\n        Ok(())\n    }\n}\n\n/// TLS settings mirroring Python's uvicorn `ssl_*` arguments.\n#[derive(Debug, Clone, PartialEq, Eq, Serialize)]\npub struct TlsConfig {\n    /// PEM certificate chain file. Required when TLS is configured; may also\n    /// hold the private key (combined PEM) when `key_file` is unset.\n    pub cert_file: Option<String>,\n    /// PEM private key file. When `None`, the key is read from `cert_file`\n    /// (combined PEM).\n    pub key_file: Option<String>,\n    /// PEM CA bundle used to verify client certificates (mTLS). Required when\n    /// `cert_reqs` is non-zero.","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/vllm-project/vllm/blob/c794754062d49a8fdb63ab3c5215b488b865030c/rust/src/server/src/config.rs#L84-L120","documentation":"Thrown by CorsConfig::validate() when a --allowed-headers entry (other than \"*\") fails to parse as an http::HeaderName. Like the methods check, this is startup-time validation so the CORS layer can be constructed infallibly later. Header names must be valid HTTP token characters (no spaces, colons, or non-ASCII).","triggerScenarios":"Passing --allowed-headers with values like 'Content-Type:' (trailing colon), 'X Custom-Header' (space), 'content-type;' or a whole comma-joined list as a single entry. Any entry containing characters illegal in a header name (spaces, CTLs, non-token chars) fails Method/HeaderName parsing at boot.","commonSituations":"Porting an Access-Control-Allow-Headers value verbatim from a Python uvicorn/fastapi deployment ('Content-Type, Authorization' as one string), or including the header value instead of only the name.","solutions":["Pass each header as a separate, exact header name: --allowed-headers Content-Type --allowed-headers Authorization.","Use \"*\" to allow all headers.","Remove colons, commas, and whitespace from each entry.","Inspect the {header:?} value in the error to find the offending entry."],"exampleFix":"# before\n--allowed-headers 'Content-Type, Authorization'\n\n# after\n--allowed-headers Content-Type --allowed-headers Authorization\n# or\n--allowed-headers '*'","handlingStrategy":"validation","validationCode":"fn valid_headers(headers: &[String]) -> bool {\n    headers.iter().all(|h| h == \"*\" || h.parse::<http::header::HeaderName>().is_ok())\n}","typeGuard":"fn is_valid_header_list(headers: &[String]) -> bool {\n    headers.iter().all(|h| h == \"*\" || h.parse::<http::header::HeaderName>().is_ok())\n}","tryCatchPattern":null,"preventionTips":["Never include colons, commas, or values — header names only.","Split Access-Control-Allow-Headers strings on ',' and trim before reusing them as flags.","Validate the full CorsConfig with validate() in a config preflight."],"tags":["configuration","cors","http-headers","rust","vllm","startup"],"backgroundTag":null,"analyzedSha":"c794754062d49a8fdb63ab3c5215b488b865030c","analyzedAt":"2026-08-14T21:17:39.825Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}