{"id":"03516672c8eb9e81","repo":"mongodb/node-mongodb-native","slug":"auth-mechanism-property-allowed-hosts-is-not-allow","errorCode":null,"errorMessage":"Auth mechanism property ALLOWED_HOSTS is not allowed in the connection string.","messagePattern":"Auth mechanism property ALLOWED_HOSTS is not allowed in the connection string\\.","errorType":"exception","errorClass":"MongoParseError","httpStatus":null,"severity":"error","filePath":"src/connection_string.ts","lineNumber":322,"sourceCode":"  }\n\n  const objectOptions = new CaseInsensitiveMap<unknown>(\n    Object.entries(options).filter(([, v]) => v != null)\n  );\n\n  // Validate options that can only be provided by one of uri or object\n\n  if (urlOptions.has('serverApi')) {\n    throw new MongoParseError(\n      'URI cannot contain `serverApi`, it can only be passed to the client'\n    );\n  }\n\n  const uriMechanismProperties = urlOptions.get('authMechanismProperties');\n  if (uriMechanismProperties) {\n    for (const property of uriMechanismProperties) {\n      if (/(^|,)ALLOWED_HOSTS:/.test(property as string)) {\n        throw new MongoParseError(\n          'Auth mechanism property ALLOWED_HOSTS is not allowed in the connection string.'\n        );\n      }\n    }\n  }\n\n  if (objectOptions.has('loadBalanced')) {\n    throw new MongoParseError('loadBalanced is only a valid option in the URI');\n  }\n\n  // All option collection\n\n  const allProvidedOptions = new CaseInsensitiveMap<unknown[]>();\n\n  const allProvidedKeys = new Set<string>([...urlOptions.keys(), ...objectOptions.keys()]);\n\n  for (const key of allProvidedKeys) {\n    const values = [];","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/connection_string.ts#L304-L340","documentation":"Thrown when the authMechanismProperties URI parameter contains an ALLOWED_HOSTS entry. ALLOWED_HOSTS is a security-sensitive OIDC property that must be configured programmatically via the options object so it cannot be leaked through URLs, logs, or DNS records. The regex at connection_string.ts:321 matches both 'ALLOWED_HOSTS:...' and ',ALLOWED_HOSTS:...'.","triggerScenarios":"Using MONGODB-OIDC with a URI like 'mongodb+srv://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ALLOWED_HOSTS:example.com,TOKEN_AUDIENCE:...'. Any ALLOWED_HOSTS value in authMechanismProperties triggers this.","commonSituations":"Configuring OIDC against Azure AD or another identity provider; copy-pasting a provider sample that put ALLOWED_HOSTS in the connection string; upgrading the driver and hitting the newly-enforced restriction.","solutions":["Remove ALLOWED_HOSTS from the authMechanismProperties URI parameter.","Set OIDC allowed hosts via the options object: new MongoClient(uri, { authMechanismProperties: { ALLOWED_HOSTS: ['example.com'] }, authMechanism: 'MONGODB-OIDC' }).","Keep only non-ALLOWED_HOSTS properties (e.g. TOKEN_AUDIENCE, ENVIRONMENT) in the URI."],"exampleFix":"// before\nconst uri = 'mongodb+srv://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ALLOWED_HOSTS:example.com,TOKEN_AUDIENCE:aud';\n// after\nconst c = new MongoClient('mongodb+srv://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=TOKEN_AUDIENCE:aud', {\n  authMechanismProperties: { ALLOWED_HOSTS: ['example.com'] }\n});","handlingStrategy":"validation","validationCode":"const amp = new URLSearchParams(new URL(uri).searchParams.get('authMechanismProperties') ?? '');\nif (amp.has('ALLOWED_HOSTS')) {\n  throw new Error('Move ALLOWED_HOSTS to options.authMechanismProperties');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat OIDC properties (ALLOWED_HOSTS) as code-only config, never in URLs.","Centralize auth-mechanism property parsing in a helper.","Audit URIs in logs to ensure no ALLOWED_HOSTS leak."],"tags":["connection-string","auth","oidc","security"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}