{"record":{"id":"c554fc867d8e138a","repo":"badges/shields","slug":"requested-origin-not-authorized","errorCode":null,"errorMessage":"requested origin not authorized","messagePattern":"requested origin not authorized","errorType":"validation","errorClass":"InvalidParameter","httpStatus":null,"severity":"error","filePath":"core/base-service/auth-helper.js","lineNumber":136,"sourceCode":"    return this.isConfigured && !originViolation && !strictSslCheckViolation\n  }\n\n  get _basicAuth() {\n    const { _user: username, _pass: password } = this\n    return this.isConfigured\n      ? { username: username || '', password: password || '' }\n      : undefined\n  }\n\n  /*\n   * Helper function for `withBasicAuth()` and friends.\n   */\n  _withAnyAuth(requestParams, mergeAuthFn) {\n    this.enforceStrictSsl(requestParams)\n\n    const shouldAuthenticate = this.shouldAuthenticateRequest(requestParams)\n    if (this.isRequired && !shouldAuthenticate) {\n      throw new InvalidParameter({\n        prettyMessage: 'requested origin not authorized',\n      })\n    }\n\n    return shouldAuthenticate ? mergeAuthFn(requestParams) : requestParams\n  }\n\n  static _mergeAuth(requestParams, auth) {\n    const { options, ...rest } = requestParams\n    return {\n      options: {\n        ...auth,\n        ...options,\n      },\n      ...rest,\n    }\n  }\n","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/badges/shields/blob/766fd8bc89a90b8534dc573ab72dec30215ab1ec/core/base-service/auth-helper.js#L118-L154","documentation":"_withAnyAuth is the shared pipeline for all auth helpers; after enforceStrictSsl it checks `shouldAuthenticateRequest(requestParams)`. If authentication is marked required (`this.isRequired`) but the request's origin is not in the authorized-origin allowlist, authentication would silently be skipped for a service that must always authenticate — so it throws InvalidParameter 'requested origin not authorized'.","triggerScenarios":"Calling withBasicAuth/withApiKeyHeader/withBearerAuthHeader/withQueryStringAuth/withJwtAuth with a target URL whose `${protocol}//${host}` origin is not listed in the service's `_authorizedOrigins`, while the service is configured with auth required (e.g. `auth: { user, pass }` plus a domain allowlist mismatch).","commonSituations":"Redirecting credentials to a different subdomain or mirror (http vs https counts as a different origin); a service whose authorizedOrigins config uses 'example.com' but the request goes to 'https://api.example.com'; trailing-slash/port mismatches in configured origins.","solutions":["Make the request origin exactly match an authorized origin string (scheme + host), e.g. use https://api.github.com if that is what is allowlisted","Fix the service's `_authorizedOrigins` (via the `authorizedOrigins` config option) to include the actual origin you are calling","Check protocol and port: http://host and https://host are different origins; include the port in the configured origin if non-default","If the request is meant to be unauthenticated, configure the service so auth is not required"],"exampleFix":"// before (service configured with authorizedOrigins: ['https://example.com'])\nconst params = service.withBasicAuth({ url: 'https://api.example.com/v2/status' })\n// after\nservice._authorizedOrigins.push('https://api.example.com') // or call the allowlisted origin\nconst params = service.withBasicAuth({ url: 'https://example.com/v2/status' })","handlingStrategy":"validation","validationCode":"function assertOriginAuthorized(url, authorizedOrigins) {\n  const { protocol, host } = new URL(url)\n  const origin = `${protocol}//${host}`\n  if (!authorizedOrigins.includes(origin)) {\n    throw new Error(`requested origin not authorized: ${origin} not in ${authorizedOrigins.join(', ')}`)\n  }\n}\nassertOriginAuthorized(requestParams.url, service._authorizedOrigins)","typeGuard":"function isAuthorizedOrigin(url, authorizedOrigins = []) {\n  try {\n    const { protocol, host } = new URL(url)\n    return authorizedOrigins.includes(`${protocol}//${host}`)\n  } catch { return false }\n}","tryCatchPattern":"try {\n  const params = service.withApiKeyHeader(requestParams)\n} catch (err) {\n  if (err.prettyMessage === 'requested origin not authorized') {\n    console.error(`Origin ${new URL(requestParams.url).origin} missing from authorizedOrigins`)\n  } else throw err\n}","preventionTips":["Keep scheme, host and port of requests identical to the configured authorized origins","Remember http and https are different origins; never mix","Document the allowlist in service config so mirrors/subdomains are added deliberately","Test auth wrappers against the exact production origins in CI"],"tags":["auth","security","origin","invalid-parameter"],"backgroundTag":"origin-not-authorized","analyzedSha":"766fd8bc89a90b8534dc573ab72dec30215ab1ec","analyzedAt":"2026-08-30T01:40:27.499Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}