joewalnes/websocketd · error

origin list matches were not found

Error message

origin list matches were not found

What it means

Raised when config.AllowOrigins is non-nil (the operator passed --origin entries) but matchOrigin finds no entry matching the request's origin host, port, and scheme. Like the same-origin violation, it causes the WebSocket handshake to be answered with 403 by gorilla's Upgrader. It is the allow-list counterpart of the implicit same-origin policy.

Source

Thrown at libwebsocketd/http.go:385

		if err != nil {
			log.Access("session", "Origin hostname parsing error: %s", err)
			return err
		}
		if config.SameOrigin {
			localServer, localPort, err := tellHostPort(req.Host, req.TLS != nil)
			if err != nil {
				log.Access("session", "Request hostname parsing error: %s", err)
				return err
			}
			if originServer != localServer || originPort != localPort {
				log.Access("session", "Same origin policy mismatch")
				return fmt.Errorf("same origin policy violated")
			}
		}
		if config.AllowOrigins != nil {
			if !matchOrigin(originServer, originPort, originParsed.Scheme, config.AllowOrigins) {
				log.Access("session", "Origin is not listed in allowed list")
				return fmt.Errorf("origin list matches were not found")
			}
		}
	}
	return nil
}

// matchOrigin checks if the given origin server/port/scheme matches any entry
// in the allowed origins list. Extracted for testability.
//
// Port semantics (issue #473): an entry with an explicit port matches that
// port only. A portless entry matches only the scheme's default port (80 for
// http, 443 for https — both, if the entry carries no scheme). Appending
// ":*" opts back in to matching any port, e.g. --origin=trusted.com:*, for
// setups where every service on the host is trusted. Portless entries used
// to match any port implicitly, so a single allowlisted host also vouched
// for whatever else happened to listen on its other ports.
func matchOrigin(originServer, originPort, originScheme string, allowedOrigins []string) bool {
	for _, allowed := range allowedOrigins {

View on GitHub (pinned to 7a8683dc7f)

Solutions

1. Compare the browser console / access log's reported origin against each --origin entry and correct scheme, host, and port.
2. Use a wildcard pattern in --origin (e.g. --origin=*.example.com) if the frontend moves between subdomains or ports.
3. Include both http and https variants during a TLS migration.
4. Verify no proxy strips or alters the Origin header before it reaches websocketd.

Example fix

// before
websocketd --port=8080 --origin=http://localhost:3000 ./chat.sh
// after (frontend migrated to https:3001)
websocketd --port=8080 --origin=http://localhost:3000 --origin=https://localhost:3001 ./chat.sh

function originAllowed(origin, allowList) {
  return allowList.some(pattern => pattern === origin || matchGlob(pattern, origin));
}
if (!originAllowed('https://localhost:3001', ['http://localhost:3000'])) console.warn('origin not in --origin list');

const ws = new WebSocket(url);
ws.onerror = () => fetch(url.replace('ws','http')).then(r => {
  if (r.status === 403) console.error('origin not allowed: check --origin entries');
});

When it happens

Trigger: Client's Origin header (scheme, host, port) does not match any entry in --origin: wrong port, http vs https scheme mismatch, subdomain not listed, wildcard pattern not covering the actual origin, or trailing-slash/scheme-case differences.

Common situations: Typo or stale port in --origin after redeploying the frontend; switching the frontend to https while the allow-list still says http; wildcard misconfigured so *.example.com doesn't match example.com itself; multi-environment deployments sharing one origin list.

Related errors

• same origin policy violated
• script not found
• too many forks active
• --anyorigin means 'accept any origin' and cannot be combined
• --maxframesize must not be negative; use 0 for unlimited

AI-assisted analysis of joewalnes/websocketd@7a8683dc7f (2026-09-03). Data as JSON: /api/errors/c041527cd8f53b77. Report an issue: GitHub.