{"record":{"id":"d2c8ea5fcd14e9e7","repo":"tinyhumansai/openhuman","slug":"host-host-is-not-in-browser-allowed-domains","errorCode":null,"errorMessage":"Host '{host}' is not in browser.allowed_domains","messagePattern":"Host '(.+?)' is not in browser\\.allowed_domains","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/openhuman/tools/impl/browser/browser_open.rs","lineNumber":49,"sourceCode":"\n        if !url.starts_with(\"https://\") {\n            anyhow::bail!(\"Only https:// URLs are allowed\");\n        }\n\n        if self.allowed_domains.is_empty() {\n            anyhow::bail!(\n                \"Browser tool is enabled but no allowed_domains are configured. Add [browser].allowed_domains in config.toml\"\n            );\n        }\n\n        let host = extract_host(url)?;\n\n        if is_private_or_local_host(&host) {\n            anyhow::bail!(\"Blocked local/private host: {host}\");\n        }\n\n        if !host_matches_allowlist(&host, &self.allowed_domains) {\n            anyhow::bail!(\"Host '{host}' is not in browser.allowed_domains\");\n        }\n\n        Ok(url.to_string())\n    }\n}\n\n#[async_trait]\nimpl Tool for BrowserOpenTool {\n    fn name(&self) -> &str {\n        \"browser_open\"\n    }\n\n    fn description(&self) -> &str {\n        \"Open an approved HTTPS URL in Brave Browser. Security constraints: allowlist-only domains, no local/private hosts, no scraping.\"\n    }\n\n    fn parameters_schema(&self) -> serde_json::Value {\n        json!({","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/tools/impl/browser/browser_open.rs#L31-L67","documentation":"Allowlist enforcement in BrowserOpenTool::validate_url. After https-only and configured-allowlist checks, the extracted host is matched against browser.allowed_domains (normalize_allowed_domains-applied); a host that matches no entry (including wildcard suffixes) is refused. It fires whenever the user opens a URL on a domain not explicitly allowlisted in config.toml — a deliberate security boundary, not a misconfiguration.","triggerScenarios":"Thrown at src/openhuman/tools/impl/browser/browser_open.rs:49 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add the host (or wildcard pattern) to [browser].allowed_domains.","Choose a URL on an already-allowed domain."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}