decolua/9router · error

Invalid region

Error message

Invalid region

What it means

assertValidAwsRegion validates a region string against AWS_REGION_PATTERN before it is interpolated into upstream AWS/Kiro URLs. This is an SSRF guard (GHSA-6mwv-4mrm-5p3m): a region like `us-east-1/../../evil` or containing scheme characters must never reach URL construction.

Source

Thrown at src/lib/oauth/constants/oauth.js:73

  return { ideType: 9, platform: getOAuthPlatformEnum(), pluginType: 2 };
}

// OpenAI OAuth Configuration (Authorization Code Flow with PKCE)
export const OPENAI_CONFIG = { ...PROVIDER_OAUTH["openai"] };

// GitHub Copilot OAuth Configuration (Device Code Flow)
export const GITHUB_CONFIG = { ...PROVIDER_OAUTH["github"] };

// Kiro OAuth Configuration (multi-method: AWS Builder ID / IDC / Social / Import Token)
export const KIRO_CONFIG = { ...PROVIDER_OAUTH["kiro"] };

// AWS region allowlist pattern — prevents SSRF via region injection into upstream URLs (GHSA-6mwv-4mrm-5p3m)
export const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\d{1,2}$/;

// Reject any region that is not a valid AWS region before interpolating it into a URL
export function assertValidAwsRegion(region) {
  if (typeof region !== "string" || !AWS_REGION_PATTERN.test(region)) {
    throw new Error("Invalid region");
  }
  return region;
}

// Cursor OAuth Configuration (Import Token from Cursor IDE)
// tokenStoragePaths: user-reference only, not stored in registry
export const CURSOR_CONFIG = {
  ...PROVIDER_OAUTH["cursor"],
  tokenStoragePaths: {
    linux: "~/.config/Cursor/User/globalStorage/state.vscdb",
    macos: "/Users/<user>/Library/Application Support/Cursor/User/globalStorage/state.vscdb",
    windows: "%APPDATA%\\Cursor\\User\\globalStorage\\state.vscdb",
  },
};

// Kimi Code OAuth (Device Code Flow) — merged into provider id `kimi` (dual auth)
// clientId: registry first, env override for forks
export const KIMI_CONFIG = {

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Set a correct lowercase AWS region on the Kiro account/credentials, e.g. "us-east-1".
2. Trim/normalize input: pass region.trim().toLowerCase() before use.
3. Open the stored Kiro account in the dashboard and fix the region field, or re-import the account with a valid region.
4. If the region comes from an env/config variable, verify it is set and shaped like e.g. eu-central-1 (2-letter country, name, 1-2 digit).

Example fix

// before
await refreshToken(account, { region: account.Region || undefined });
// after
const region = (account.Region || "us-east-1").trim().toLowerCase();
assertValidAwsRegion(region); // throws early with a clear message if invalid
await refreshToken(account, { region });

const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\d{1,2}$/;
function regionIsSafe(region) {
  return typeof region === "string" && AWS_REGION_PATTERN.test(region.trim());
}
if (!regionIsSafe(account.region)) throw new Error("Kiro account has an invalid AWS region");

function isValidAwsRegion(x) {
  return typeof x === "string" && /^[a-z]{2}-[a-z]+-\d{1,2}$/.test(x);
}

try {
  await refreshToken(account, { region });
} catch (err) {
  if (err.message === "Invalid region") {
    throw new Error(`Kiro account region "${region}" is not a valid AWS region — fix it in account settings`);
  }
  throw err;
}

When it happens

Trigger: Any of kiro, registerClient, startDeviceAuthorization, pollDeviceToken, refreshToken, or listAvailableProfiles receiving a region that is not a string matching ^[a-z]{2}-[a-z]+-\d{1,2}$ — e.g. undefined region, "us-east-1 " with whitespace, uppercase "US-EAST-1", or a region field polluted with path/URL fragments.

Common situations: Kiro OAuth account imported with an empty or malformed region field in its stored credentials; hand-edited config using uppercase or an alias like "us-east1" (missing hyphen); passing the whole endpoint URL instead of just the region.

Related errors

• Missing Zed callback URL
• Invalid Zed callback URL
• Zed callback must include user_id and access_token
• Missing xAI authorization code
• Missing accessToken

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/cffec89b6788d652. Report an issue: GitHub.