cube-js/cube · error · TypeError

The ${keyByDataSource('CUBEJS_DB_SSL_REJECT_UNAUTHORIZED', d

Error message

The ${keyByDataSource('CUBEJS_DB_SSL_REJECT_UNAUTHORIZED', dataSource)} must be either 'true' or 'false'.

What it means

CUBEJS_DB_SSL_REJECT_UNAUTHORIZED controls whether TLS certificates are validated, and Cube accepts only 'true' or 'false' (case-insensitive); other values throw a TypeError naming the data-source-specific variable. This mirrors the Node.js tls option of the same name.

Source

Thrown at packages/cubejs-backend-shared/src/env.ts:432

        } must be either 'true' or 'false'.`
      );
    }
  },

  /**
   * Reject unauthorized SSL connection flag.
   */
  dbSslRejectUnauthorized: ({
    dataSource,
    preAggregations,
  }: DataSourceOpts) => {
    const val = get(keyByDataSource('CUBEJS_DB_SSL_REJECT_UNAUTHORIZED', dataSource, preAggregations)).default('false').asString();
    if (val.toLocaleLowerCase() === 'true') {
      return true;
    } else if (val.toLowerCase() === 'false') {
      return false;
    } else {
      throw new TypeError(
        `The ${
          keyByDataSource('CUBEJS_DB_SSL_REJECT_UNAUTHORIZED', dataSource)
        } must be either 'true' or 'false'.`
      );
    }
  },

  /**
   * Database URL.
   */
  dbUrl: ({
    dataSource,
    preAggregations,
  }: DataSourceOpts) => (
    get(keyByDataSource('CUBEJS_DB_URL', dataSource, preAggregations)).asString()
  ),

  /**

View on GitHub (pinned to 7d981676b3)

Solutions

Set the variable to exactly true or false.
Use false (not 0) when disabling certificate rejection, and prefer fixing trust chains over disabling validation.
Echo the value via node -p "JSON.stringify(process.env.X)" to catch stray quotes/whitespace.
Fix your deployment templating (Helm/envsubst) so it doesn't wrap booleans in quotes.

Example fix

// before
CUBEJS_DB_SSL_REJECT_UNAUTHORIZED=0
// after
CUBEJS_DB_SSL_REJECT_UNAUTHORIZED=false

Defensive patterns

Strategy: validation

Validate before calling

const v = process.env.CUBEJS_DB_SSL_REJECT_UNAUTHORIZED;
if (v !== undefined && !/^(true|false)$/i.test(v.trim()))
  throw new Error(`CUBEJS_DB_SSL_REJECT_UNAUTHORIZED must be 'true' or 'false', got: ${JSON.stringify(v)}`);

Type guard

function isSslRejectBool(v: unknown): v is 'true' | 'false' {
  return typeof v === 'string' && /^(true|false)$/i.test(v.trim());
}

Try / catch

try {
  sslRejectUnauthorized(dataSource);
} catch (e) {
  if (e instanceof TypeError && e.message.includes('SSL_REJECT_UNAUTHORIZED')) {
    console.error('Use exactly true or false; disable cert rejection only with a fixed trust chain');
  }
  throw e;
}

Prevention

Use false (not 0) when bypassing cert validation, and prefer adding the CA to the trust store.
Strip quotes in deployment templates that wrap boolean env values.
Validate all *_SSL_* env vars in a startup smoke test.

When it happens

Trigger: Setting CUBEJS_DB_SSL_REJECT_UNAUTHORIZED (or CUBEJS_DS_<DS>_SSL_REJECT_UNAUTHORIZED) to '1', '0', 'yes', 'no', or a value polluted by quotes/newlines from shell or secret-manager quoting.

Common situations: Trying to disable cert validation for self-signed certs using 0 instead of false; secrets manager adding surrounding quotes; Docker compose quoting quirks producing '"false"'.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/4a81db396a24de81. Report an issue: GitHub.