{"record":{"id":"c5eece1c0ec22a7b","repo":"abhigyanpatwari/GitNexus","slug":"gitnexus-serve-ignoring-public-origin-env-r","errorCode":null,"errorMessage":"[gitnexus serve] Ignoring ${PUBLIC_ORIGIN_ENV}=${raw} — not a single reachable origin, so it admits nothing. Set it to one host, optionally with a scheme and a port.","messagePattern":"\\[gitnexus serve\\] Ignoring (.+?)=(.+?) — not a single reachable origin, so it admits nothing\\. Set it to one host, optionally with a scheme and a port\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"gitnexus/src/server/middleware.ts","lineNumber":274,"sourceCode":"  );\n}\n\n/**\n * Report at startup what {@link createWriteOriginGuard} will admit, so an\n * operator can see it without reproducing a 403. A wildcard bind always warns —\n * gating that on {@link PUBLIC_ORIGIN_ENV} being constructible would diagnose a\n * misconfigured value worse than an absent one.\n */\nexport function logOriginPolicy(boundHost?: string): void {\n  const raw = process.env[PUBLIC_ORIGIN_ENV]?.trim();\n  const publicOrigin = createPublicOriginMatcher(raw);\n  if (publicOrigin) {\n    logger.info(\n      { [PUBLIC_ORIGIN_ENV]: raw, hostname: publicOrigin.hostname },\n      `[gitnexus serve] Browser write routes also accept origins on ${publicOrigin.hostname}.`,\n    );\n  } else if (raw) {\n    logger.warn(\n      { [PUBLIC_ORIGIN_ENV]: raw },\n      `[gitnexus serve] Ignoring ${PUBLIC_ORIGIN_ENV}=${raw} — not a single reachable origin, ` +\n        `so it admits nothing. Set it to one host, optionally with a scheme and a port.`,\n    );\n  }\n\n  if (!boundHost || normalizeBoundHost(boundHost) !== undefined) return;\n  const admitted = publicOrigin\n    ? `accept loopback origins (localhost/127.0.0.1/[::1]) and ${publicOrigin.hostname} via ` +\n      `${PUBLIC_ORIGIN_ENV}.`\n    : `accept only loopback origins (localhost/127.0.0.1/[::1]). To admit writes from a specific ` +\n      `LAN address, bind --host <that-address> instead of a wildcard; to admit them from a ` +\n      `public origin, set ${PUBLIC_ORIGIN_ENV} to it.`;\n  logger.warn(\n    { host: boundHost },\n    `[gitnexus serve] Bound to a wildcard address (${boundHost}); browser write routes ${admitted}`,\n  );\n}","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/aac7515d2a8c50a1f8f923c6fb77218b333560d6/gitnexus/src/server/middleware.ts#L256-L292","documentation":"logOriginPolicy validates the PUBLIC_ORIGIN_ENV value with createPublicOriginMatcher. A value that is not exactly one reachable origin (multiple hosts, a wildcard, or unparseable text) constructs no matcher, so it admits nothing beyond loopback for browser write routes, and this warning fires stating the value was ignored. The design prefers diagnosing a misconfigured value over an absent one.","triggerScenarios":"Starting gitnexus serve with GITNEXUS_PUBLIC_ORIGIN set to two origins, a wildcard like '*', or unparseable text: the browser-write CORS policy silently stays loopback-only despite the env var being set, and the warning is emitted at startup.","commonSituations":"Trying to allowlist several frontends with one env var; assuming glob or regex syntax; stray quotes or whitespace in the value; browser writes from the LAN then failing CORS even though the operator believes the origin was configured.","solutions":["Set the value to exactly one host, optionally with a scheme and a port: GITNEXUS_PUBLIC_ORIGIN=gitnexus.example.com or https://app.example.com:3000","For LAN write access, bind --host <specific-lan-address> instead of a wildcard","Unset the variable entirely if only loopback origins need write access"],"exampleFix":"# before\nexport GITNEXUS_PUBLIC_ORIGIN='https://a.example.com, https://b.example.com'   # ignored, admits nothing\n\n# after\nexport GITNEXUS_PUBLIC_ORIGIN='https://a.example.com'   # single origin admitted","handlingStrategy":"validation","validationCode":"const raw = process.env.GITNEXUS_PUBLIC_ORIGIN?.trim();\nconst matcher = raw ? createPublicOriginMatcher(raw) : undefined;\nif (raw && !matcher) {\n  // the value will be ignored and write routes stay loopback-only\n  throw new Error('GITNEXUS_PUBLIC_ORIGIN must be exactly one host [+scheme +port]');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["One origin per env var — no wildcards, no comma lists","Validate the value with URL parsing in deploy scripts before starting serve","If browser write CORS fails from your LAN host, check for this startup warning first"],"tags":["cors","origin","server","configuration","env-var"],"backgroundTag":"invalid-origin-configuration","analyzedSha":"aac7515d2a8c50a1f8f923c6fb77218b333560d6","analyzedAt":"2026-08-20T23:29:22.980Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}