joewalnes/websocketd · error

please only specify one of --binary and --passstderr

Error message

please only specify one of --binary and --passstderr

What it means

validateBinaryPassStderr rejects using --binary together with --passstderr. Tagging binary chunks as JSON is not implemented (--passstderr reads line by line), so combining them would silently discard --binary; the server refuses the combination instead.

Source

Thrown at config.go:153

	if ssl {
		if certFile == "" || keyFile == "" {
			return fmt.Errorf("please specify both --sslcert and --sslkey when requesting --ssl")
		}
	} else {
		if certFile != "" || keyFile != "" {
			return fmt.Errorf("you should not be using --ssl* flags when there is no --ssl option")
		}
	}
	return nil
}

// validateBinaryPassStderr checks that --binary and --passstderr aren't both
// set. Tagging binary chunks as JSON isn't implemented (--passstderr always
// reads line by line), so combining the two would silently discard --binary
// instead of behaving as either flag alone.
func validateBinaryPassStderr(binary, passStderr bool) error {
	if binary && passStderr {
		return fmt.Errorf("please only specify one of --binary and --passstderr")
	}
	return nil
}

// validateAnyOrigin checks that --anyorigin is not combined with an actual
// origin policy. The flags say opposite things, and silently preferring one
// would hide operator confusion.
func validateAnyOrigin(anyOrigin, sameOrigin bool, allowOrigins []string) error {
	if anyOrigin && (sameOrigin || allowOrigins != nil) {
		return fmt.Errorf("--anyorigin means 'accept any origin' and cannot be combined with --sameorigin or --origin, which restrict it")
	}
	return nil
}

// validateMaxFrameSize rejects negative --maxframesize values. The read
// limit is only applied for positive values, so a negative value silently
// meant "unlimited" — the one value an operator can pass that quietly
// removes the DoS protection the flag exists for (issue #472).

View on GitHub (pinned to 7a8683dc7f)

Solutions

1. Choose one: keep --binary for binary-safe stdout frames, or --passstderr to forward stderr as JSON-tagged messages
2. If you need both binary data and stderr, run stderr forwarding in a wrapper script instead

Example fix

// before
websocketd --binary --passstderr --port=8080 ./app
// after
websocketd --binary --port=8080 ./app

if (args.includes('--binary') && args.includes('--passstderr')) throw new Error('--binary and --passstderr are mutually exclusive');

const outputMode = (c) => ['binary','passstderr','default'].find(m => m === (c.binary ? 'binary' : c.passstderr ? 'passstderr' : 'default'));

try { startServer(args) } catch (e) { if (/only specify one of --binary/.test(e)) console.error('pick a single output mode'); throw e; }

When it happens

Trigger: Running websocketd with both --binary and --passstderr set at startup.

Common situations: Adding --passstderr to a setup that already used --binary to capture stderr output; misunderstanding that the flags are mutually exclusive transport/output modes.

Related errors

• --socketmode %q is not an octal permission mode (e.g. 0700)
• --socketmode %q has bits beyond permission bits (keep it wit
• --socketmode 0 would make the socket unusable; pick a mode l
• please specify both --sslcert and --sslkey when requesting -
• you should not be using --ssl* flags when there is no --ssl

AI-assisted analysis of joewalnes/websocketd@7a8683dc7f (2026-09-03). Data as JSON: /api/errors/da0b78530944ae61. Report an issue: GitHub.