incorrect format for specifying Dgraph.Allow-Origin found fo

Error message

incorrect format for specifying Dgraph.Allow-Origin found for comment: `%s`, it should be `# Dgraph.Allow-Origin "http://example.com"`

What it means

The `# Dgraph.Allow-Origin` schema comment must have exactly three whitespace-separated fields: the comment marker, the directive name, and a JSON-quoted origin. If the line splits into a number of fields other than 3, parseMetaInfo returns this error describing the correct format.

Source

Thrown at graphql/schema/schemagen.go:222

	var err error
	for scanner.Scan() {
		text := strings.TrimSpace(scanner.Text())

		if strings.HasPrefix(text, "#") {
			header := strings.TrimSpace(text[1:])
			if strings.HasPrefix(header, "Dgraph.Authorization") {
				if authSecret != "" {
					return nil, errors.Errorf("Dgraph.Authorization should be only be specified once in "+
						"a schema, found second mention: %v", text)
				}
				authSecret = text
				continue
			}

			if strings.HasPrefix(header, "Dgraph.Allow-Origin") {
				parts := strings.Fields(text)
				if len(parts) != 3 {
					return nil, errors.Errorf("incorrect format for specifying Dgraph.Allow-Origin"+
						" found for comment: `%s`, it should be `# Dgraph."+
						"Allow-Origin \"http://example.com\"`", text)
				}
				var allowedOrigin string
				if err = json.Unmarshal([]byte(parts[2]), &allowedOrigin); err != nil {
					return nil, errors.Errorf("incorrect format for specifying Dgraph.Allow-Origin"+
						" found for comment: `%s`, it should be `# Dgraph."+
						"Allow-Origin \"http://example.com\"`", text)
				}
				schMetaInfo.allowedCorsOrigins[allowedOrigin] = true
				continue
			}

			if !strings.HasPrefix(header, "Dgraph.Secret") {
				continue
			}
			parts := strings.Fields(text)
			const doubleQuotesCode = 34

View on GitHub (pinned to 759e242be6)

Solutions

Quote the origin as a JSON string: `# Dgraph.Allow-Origin "http://example.com"`.
Remove any extra tokens on the line (no trailing comments).
For all origins use the JSON-quoted wildcard: `# Dgraph.Allow-Origin "*"`.

Example fix

// before
# Dgraph.Allow-Origin http://example.com
// after
# Dgraph.Allow-Origin "http://example.com"

Defensive patterns

Strategy: validation

Validate before calling

// verify format before submitting schema
for _, line := range strings.Split(schemaText, "\n") {
    t := strings.TrimSpace(line)
    if strings.HasPrefix(t, "# Dgraph.Allow-Origin") {
        parts := strings.Fields(t)
        if len(parts) != 3 {
            return fmt.Errorf("bad Allow-Origin line (need 3 fields): %s", t)
        }
        var origin string
        if err := json.Unmarshal([]byte(parts[2]), &origin); err != nil {
            return fmt.Errorf("origin must be a JSON string: %s", t)
        }
    }
}

Try / catch

h, err := schema.NewHandler(...)
if err != nil {
    if strings.Contains(err.Error(), "Dgraph.Allow-Origin") {
        return fmt.Errorf("fix # Dgraph.Allow-Origin comment format: %w", err)
    }
    return err
}

Prevention

Always double-quote the origin: # Dgraph.Allow-Origin "http://example.com".
No trailing text after the quoted origin.
Lint Dgraph meta comments in CI with the same field-count check.
Keep CORS origins in one managed schema section.

When it happens

Trigger: Calling NewHandler/schema generation with a comment like `# Dgraph.Allow-Origin *` or `# Dgraph.Allow-Origin` or an origin plus extra tokens — anything where strings.Fields(text) does not yield exactly 3 parts.

Common situations: Writing the origin without quotes (`# Dgraph.Allow-Origin http://example.com`); using `*` unquoted; trailing comments on the same line; extra whitespace tokens.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/60b32f01be159deb. Report an issue: GitHub.