{"record":{"id":"f7603d60fe13ad15","repo":"vi/websocat","slug":"request-uri-doesn-t-match-restrict-uri-parameter","errorCode":null,"errorMessage":"Request URI doesn't match --restrict-uri parameter","messagePattern":"Request URI doesn't match --restrict-uri parameter","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/ws_server_peer.rs","lineNumber":237,"sourceCode":"                                    warn!(\"Header {} value contains invalid UTF-8\", q);\n                                }\n                            } else {\n                                warn!(\"No request header {}, so no envvar H_{}\", q, q);\n                            }\n                        }\n                    },\n                    L2rUser::ReadFrom(_) => {},\n                }\n                \n                \n                if let Some(ref restrict_uri) = *restrict_uri {\n                    let check_passed = matches!(x.request.subject.1, AbsolutePath(ref x) if x == restrict_uri);\n                    if !check_passed {\n                        return Box::new(\n                            x.reject()\n                                .and_then(|_| {\n                                    warn!(\"Incoming request URI doesn't match the --restrict-uri value\");\n                                    ::futures::future::err(crate::util::simple_err(\n                                        \"Request URI doesn't match --restrict-uri parameter\"\n                                            .to_string(),\n                                    ))\n                                })\n                                .map_err(|e| websocket::WebSocketError::IoError(io_other_error(e))),\n                        )\n                            as Box<dyn Future<Item = Peer, Error = websocket::WebSocketError>>;\n                    }\n                };\n                Box::new(x.accept_with_limits(opts.max_ws_frame_length, opts.max_ws_message_length).map(move |(y, headers)| {\n                    debug!(\"{:?}\", headers);\n                    info!(\"Upgraded\");\n                    let close_on_shutdown =  !opts.websocket_dont_close;\n                    super::ws_peer::finish_building_ws_peer(&opts, y, close_on_shutdown, None)\n                })) as Box<dyn Future<Item = Peer, Error = websocket::WebSocketError>>\n            },\n        );\n    let step4 = step3.map_err(box_up_err);","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/vi/websocat/blob/3a3574cd2f5d17857d87f3982e72c3ede159dde0/src/ws_server_peer.rs#L219-L255","documentation":"Raised during WebSocket upgrade in ws_upgrade_peer when the request URI does not equal the --restrict-uri parameter value. The check requires the request's absolute path to match restrict_uri exactly (AbsolutePath == restrict_uri); on failure the server rejects the handshake, logs a warning, and returns simple_err wrapped as a WebSocketError::IoError. This enforces that the server only accepts upgrades at one specific path.","triggerScenarios":"A client sends a WebSocket upgrade whose request path differs from --restrict-uri (e.g. server started with --restrict-uri=/echo but the client connects to / or /other), including trailing-slash or query-string/path-case differences that break exact comparison.","commonSituations":"Client URL path edited or defaulted to '/' while --restrict-uri is set; reverse proxy rewriting the path before it reaches the server; mismatch between a documented endpoint and the restrict-uri flag; trailing slash ('/echo/' vs '/echo').","solutions":["Connect to the exact path given in --restrict-uri (e.g. ws://host:8080/echo when --restrict-uri=/echo), including no trailing slash.","If the path is intentional, update --restrict-uri on the server to match it and restart.","Remove the --restrict-uri option if any path should be accepted.","Check reverse-proxy configuration for path rewrites/strips that alter the URI before it reaches the server."],"exampleFix":"// before: server started with --restrict-uri=/echo but client hits another path\nconst ws = new WebSocket(\"ws://host:8080/\");\n\n// after\nconst ws = new WebSocket(\"ws://host:8080/echo\");","handlingStrategy":"validation","validationCode":"// Client-side pre-check before connecting (JS)\nconst restrictUri = \"/echo\"; // mirrors server --restrict-uri\nconst path = new URL(wsUrl).pathname;\nif (path !== restrictUri) throw new Error(`path ${path} does not match --restrict-uri ${restrictUri}`);","typeGuard":null,"tryCatchPattern":"ws.addEventListener(\"error\", () => {\n  // rejected handshake: request URI did not match --restrict-uri\n  console.error(\"Upgrade rejected: URI does not match --restrict-uri\");\n});","preventionTips":["Derive the client URL from the same config value used for --restrict-uri.","Watch for proxies that rewrite or strip the request path.","Match exact path text (no trailing slash differences)."],"tags":["websocket","handshake","url-mismatch","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"3a3574cd2f5d17857d87f3982e72c3ede159dde0","analyzedAt":"2026-09-12T15:14:27.766Z","contentChangedAt":"2026-09-12T15:14:27.766Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}