fish2018/pansou · error

请求来源不被允许

Error message

请求来源不被允许

What it means

The panyq plugin's public Search enforces a referer allow-list when EnableRefererCheck is true. The caller-supplied ext["referer"] value did not prefix-match any entry in AllowedReferers, so the request is rejected with "请求来源不被允许".

Solutions

1. Add the caller's origin to the AllowedReferers configuration.
2. Ensure the frontend sends the Referer header and that no Referrer-Policy strips it (e.g. set referrerpolicy="no-referrer-when-downgrade").
3. Verify prefix matching expectations: "https://example.com" won't match "https://example.org" and scheme must match exactly.
4. If referer is unavailable by design, either disable EnableRefererCheck or pass the referer explicitly in ext.
5. Enable DebugLog to see the exact rejected referer value.

Example fix

// before
result, err := plugin.Search(keyword, nil) // no referer passed, check enabled -> rejected
// after
result, err := plugin.Search(keyword, map[string]interface{}{"referer": "https://your-allowed-origin.com"})

// Go (caller): ensure you send an allowed referer before calling Search
referer := "https://your-allowed-origin.com"
allowed := false
for _, a := range plugin.AllowedReferers {
    if strings.HasPrefix(referer, a) {
        allowed = true
        break
    }
}
if !allowed {
    return nil, fmt.Errorf("referer %q not in AllowedReferers; fix config or header", referer)
}

result, err := plugin.Search(keyword, ext)
if err != nil && err.Error() == "请求来源不被允许" {
    log.Printf("referer %v rejected; check AllowedReferers config and ext[\"referer\"]", ext["referer"])
    return err
}

When it happens

Trigger: Search(keyword, ext) called with ext containing a referer string that has no prefix match in AllowedReferers while EnableRefererCheck is enabled; or ext is missing the referer key (empty string) when the check is on.

Common situations: Frontend not sending Referer (browser privacy settings/Referrer-Policy stripping it); new deployment domain not added to AllowedReferers config; trailing-slash or http vs https mismatch defeating prefix match; caller simply not passing ext["referer"].

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• secret cannot be empty
• unexpected signing method
• 创建请求失败
• 账号和密码不能为空
• 创建AES加密器失败

AI-assisted analysis of fish2018/pansou@beaa561337 (2026-09-07). Data as JSON: /api/errors/029de87ebd7e0b99. Report an issue: GitHub.

Appendix: source

Thrown at plugin/panyq/panyq.go:172

		}
		
		// 检查referer是否在允许列表中
		allowed := false
		for _, allowedReferer := range AllowedReferers {
			if strings.HasPrefix(referer, allowedReferer) {
				if DebugLog {
					fmt.Printf("panyq: 允许来自 %s 的请求\n", referer)
				}
				allowed = true
				break
			}
		}
		
		if !allowed {
			if DebugLog {
				fmt.Printf("panyq: 拒绝来自 %s 的请求\n", referer)
			}
			return nil, fmt.Errorf("请求来源不被允许")
		}
	}
	
	// 使用新的异步搜索方法
	result, err := p.AsyncSearchWithResult(keyword, p.doSearch, p.MainCacheKey, ext)
	if err != nil {
		return nil, err
	}
	results := result.Results
	
	// 如果搜索成功，缓存结果
	if err == nil && len(results) > 0 {
		searchResultCacheLock.Lock()
		searchResultCache[cacheKey] = results
		searchResultCacheLock.Unlock()
	}
	
	return results, err

View on GitHub (pinned to beaa561337)