{"record":{"id":"e0ded08ee8d6370b","repo":"transloadit/uppy","slug":"uploadurls-is-required","errorCode":null,"errorMessage":"uploadUrls is required","messagePattern":"uploadUrls is required","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"packages/@uppy/companion/src/config/companion.ts","lineNumber":132,"sourceCode":"\n  if (providerOptions) {\n    const deprecatedOptions: Record<string, string> = {\n      microsoft: 'providerOptions.onedrive',\n      google: 'providerOptions.drive',\n      s3: 's3',\n    }\n    Object.keys(deprecatedOptions).forEach((deprecated) => {\n      if (Object.hasOwn(providerOptions, deprecated)) {\n        throw new Error(\n          `The Provider option \"providerOptions.${deprecated}\" is no longer supported. Please use the option \"${deprecatedOptions[deprecated]}\" instead.`,\n        )\n      }\n    })\n  }\n\n  if (uploadUrls == null || uploadUrls.length === 0) {\n    if (process.env['NODE_ENV'] === 'production') {\n      throw new Error('uploadUrls is required')\n    }\n    logger.error(\n      'Running without uploadUrls is a security risk and Companion will refuse to start up when running in production (NODE_ENV=production)',\n      'startup.uploadUrls',\n    )\n  }\n\n  const { corsOrigins } = companionOptions\n  if (corsOrigins == null) {\n    throw new TypeError(\n      'Option corsOrigins is required. To disable security, pass true',\n    )\n  }\n\n  if (corsOrigins === '*') {\n    throw new TypeError(\n      'Option corsOrigins cannot be \"*\". To disable security, pass true',\n    )","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/transloadit/uppy/blob/5d4dedd02a1ac0ae022c75c54aca76558f88e256/packages/@uppy/companion/src/config/companion.ts#L114-L150","documentation":"Companion requires uploadUrls (the allowlist of origins allowed to upload through it) when NODE_ENV=production, because running without it is a security risk (open upload proxy). In development it only logs an error.","triggerScenarios":"Starting Companion with NODE_ENV=production and no uploadUrls array (or an empty one) in companionOptions.","commonSituations":"Deploying to production with a dev-oriented config; forgetting to port uploadUrls from the old protocol/domain options when upgrading; environment variable not set in non-prod so the misconfiguration goes unnoticed until deploy.","solutions":["Add uploadUrls: ['https://your-app.example.com'] to companionOptions","Include every origin that embeds Uppy and uploads through Companion","Test with NODE_ENV=production locally to catch this before deploying"],"exampleFix":"// before\ncompanion.app({ providerOptions, server, filePath })\n\n// after\ncompanion.app({ providerOptions, server, filePath, uploadUrls: ['https://app.example.com'] })","handlingStrategy":"validation","validationCode":"if (process.env.NODE_ENV === 'production' && (!uploadUrls || uploadUrls.length === 0)) throw new Error('uploadUrls required in production')","typeGuard":"const hasUploadUrls = (o: { uploadUrls?: string[] }) => Array.isArray(o.uploadUrls) && o.uploadUrls.length > 0","tryCatchPattern":"null","preventionTips":["Always configure uploadUrls explicitly","Test with NODE_ENV=production before deploy","List every origin that uploads through Companion"],"tags":["companion","configuration","security","startup","production"],"backgroundTag":"missing-required-config","analyzedSha":"5d4dedd02a1ac0ae022c75c54aca76558f88e256","analyzedAt":"2026-08-28T12:18:41.267Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}