{"record":{"id":"fdc1a48531227df3","repo":"transloadit/uppy","slug":"option-corsorigins-is-required-to-disable-securit","errorCode":null,"errorMessage":"Option corsOrigins is required. To disable security, pass true","messagePattern":"Option corsOrigins is required\\. To disable security, pass true","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"critical","filePath":"packages/@uppy/companion/src/config/companion.ts","lineNumber":142,"sourceCode":"          `The Provider option \"providerOptions.${deprecated}\" is no longer supported. Please use the option \"${deprecatedOptions[deprecated]}\" instead.`,\n        )\n      }\n    })\n  }\n\n  if (uploadUrls == null || uploadUrls.length === 0) {\n    if (process.env['NODE_ENV'] === 'production') {\n      throw new Error('uploadUrls is required')\n    }\n    logger.error(\n      'Running without uploadUrls is a security risk and Companion will refuse to start up when running in production (NODE_ENV=production)',\n      'startup.uploadUrls',\n    )\n  }\n\n  const { corsOrigins } = companionOptions\n  if (corsOrigins == null) {\n    throw new TypeError(\n      'Option corsOrigins is required. To disable security, pass true',\n    )\n  }\n\n  if (corsOrigins === '*') {\n    throw new TypeError(\n      'Option corsOrigins cannot be \"*\". To disable security, pass true',\n    )\n  }\n}\n","sourceCodeStart":124,"sourceCodeEnd":153,"githubUrl":"https://github.com/transloadit/uppy/blob/5d4dedd02a1ac0ae022c75c54aca76558f88e256/packages/@uppy/companion/src/config/companion.ts#L124-L153","documentation":"Companion requires the corsOrigins option to be set (an array of allowed origins or true to disable the check). Passing null/undefined throws a TypeError at startup because CORS handling must be explicit.","triggerScenarios":"Starting Companion whose config has no corsOrigins key (e.g. constructed from partial objects or env vars that were undefined).","commonSituations":"Upgrading to a Companion version that made corsOrigins mandatory; building config dynamically where corsOrigins ends up undefined.","solutions":["Add corsOrigins: ['https://your-app.example.com'] to companionOptions","Pass corsOrigins: true only in trusted/testing environments to disable the check","Never pass '*' — use the array form or true"],"exampleFix":"// before\ncompanion.app({ ...opts })\n\n// after\ncompanion.app({ ...opts, corsOrigins: ['https://app.example.com'] })","handlingStrategy":"validation","validationCode":"if (companionOptions.corsOrigins == null) throw new TypeError('corsOrigins required')","typeGuard":"const hasCorsOrigins = (o: { corsOrigins?: string[] | boolean }) => o.corsOrigins != null","tryCatchPattern":"null","preventionTips":["Set corsOrigins in every environment's config","Default it to your known app origins in shared config modules"],"tags":["companion","configuration","cors","startup"],"backgroundTag":"missing-required-config","analyzedSha":"5d4dedd02a1ac0ae022c75c54aca76558f88e256","analyzedAt":"2026-08-28T12:18:41.267Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}