different-ai/openwork · critical

${envName} must be an absolute https origin.

Error message

${envName} must be an absolute https origin.

What it means

normalizeOptionalHttpsOrigin validates optional https-only env vars (identified by envName, e.g. a marketplace/Den URL). If new URL(configured) throws — value present but not an absolute URL — it throws '<envName> must be an absolute https origin.' The variable is optional, but once set it must be a valid absolute https origin.

Source

Thrown at ee/apps/den-api/src/env.ts:424

    throw new Error("DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.")
  }
  if (url.protocol !== "https:" && !allowInsecureHttp) {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.")
  }
  return url.origin
}

function normalizeOptionalHttpsOrigin(envName: string, value: string | undefined) {
  const configured = optionalString(value)
  if (!configured) {
    return undefined
  }

  let url: URL
  try {
    url = new URL(configured)
  } catch {
    throw new Error(`${envName} must be an absolute https origin.`)
  }

  if (url.protocol !== "https:") {
    throw new Error(`${envName} must be an absolute https origin.`)
  }
  if (url.username || url.password || url.search || url.hash || (url.pathname !== "/" && url.pathname !== "")) {
    throw new Error(`${envName} cannot contain credentials, a path, a query string, or a fragment.`)
  }

  return url.origin
}

function normalizeAbsoluteUrlCsv(envName: string, value: string | undefined) {
  const entries = splitCsv(value)
  const invalidEntries: string[] = []

  for (const entry of entries) {
    try {

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Provide a full absolute https origin, e.g. 'https://den.example.com', or unset the variable to use the default
2. Check for stray quotes/whitespace in the deployed env file
3. Validate locally with `node -e "new URL(process.env.VAR)"` before deploying

Example fix

// before
DEN_MARKETPLACE_ORIGIN=market.internal
// after
DEN_MARKETPLACE_ORIGIN=https://market.internal

function validateHttpsOriginVar(name: string, v: string | undefined): void {
  if (!v) return
  try {
    const u = new URL(v)
    if (u.protocol !== 'https:') throw new Error(`${name} must be an absolute https origin.`)
  } catch (e) {
    throw new Error(`${name} must be an absolute https origin.`)
  }
}

function isValidHttpsOrigin(v: string): boolean {
  try { return new URL(v).protocol === 'https:' } catch { return false }
}

try {
  bootServer(env)
} catch (e) {
  if (String((e as Error).message).endsWith('must be an absolute https origin.')) {
    console.error('Set the variable to a full https://host URL or unset it to use the default')
    process.exit(1)
  }
  throw e
}

When it happens

Trigger: Setting an https-only env var to 'example.com' (no scheme), an empty-but-truthy string, or garbage like 'localhost' without scheme.

Common situations: Typos in the value, missing scheme when documenting example configs, shell quoting leaving stray characters.

Related errors

• DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https ori
• DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a
• DEN_API_PUBLIC_URL must be an absolute http or https URL.
• PORT must be an integer between 1 and 65535
• DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/2cfdcc1772a4557c. Report an issue: GitHub.