mongodb/node-mongodb-native · error · MongoParseError

Auth mechanism property ALLOWED_HOSTS is not allowed in the

Error message

Auth mechanism property ALLOWED_HOSTS is not allowed in the connection string.

What it means

Thrown when the authMechanismProperties URI parameter contains an ALLOWED_HOSTS entry. ALLOWED_HOSTS is a security-sensitive OIDC property that must be configured programmatically via the options object so it cannot be leaked through URLs, logs, or DNS records. The regex at connection_string.ts:321 matches both 'ALLOWED_HOSTS:...' and ',ALLOWED_HOSTS:...'.

Source

Thrown at src/connection_string.ts:322

  }

  const objectOptions = new CaseInsensitiveMap<unknown>(
    Object.entries(options).filter(([, v]) => v != null)
  );

  // Validate options that can only be provided by one of uri or object

  if (urlOptions.has('serverApi')) {
    throw new MongoParseError(
      'URI cannot contain `serverApi`, it can only be passed to the client'
    );
  }

  const uriMechanismProperties = urlOptions.get('authMechanismProperties');
  if (uriMechanismProperties) {
    for (const property of uriMechanismProperties) {
      if (/(^|,)ALLOWED_HOSTS:/.test(property as string)) {
        throw new MongoParseError(
          'Auth mechanism property ALLOWED_HOSTS is not allowed in the connection string.'
        );
      }
    }
  }

  if (objectOptions.has('loadBalanced')) {
    throw new MongoParseError('loadBalanced is only a valid option in the URI');
  }

  // All option collection

  const allProvidedOptions = new CaseInsensitiveMap<unknown[]>();

  const allProvidedKeys = new Set<string>([...urlOptions.keys(), ...objectOptions.keys()]);

  for (const key of allProvidedKeys) {
    const values = [];

View on GitHub (pinned to 3366c21a63)

Solutions

Remove ALLOWED_HOSTS from the authMechanismProperties URI parameter.
Set OIDC allowed hosts via the options object: new MongoClient(uri, { authMechanismProperties: { ALLOWED_HOSTS: ['example.com'] }, authMechanism: 'MONGODB-OIDC' }).
Keep only non-ALLOWED_HOSTS properties (e.g. TOKEN_AUDIENCE, ENVIRONMENT) in the URI.

Example fix

// before
const uri = 'mongodb+srv://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ALLOWED_HOSTS:example.com,TOKEN_AUDIENCE:aud';
// after
const c = new MongoClient('mongodb+srv://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=TOKEN_AUDIENCE:aud', {
  authMechanismProperties: { ALLOWED_HOSTS: ['example.com'] }
});

Defensive patterns

Strategy: validation

Validate before calling

const amp = new URLSearchParams(new URL(uri).searchParams.get('authMechanismProperties') ?? '');
if (amp.has('ALLOWED_HOSTS')) {
  throw new Error('Move ALLOWED_HOSTS to options.authMechanismProperties');
}

Prevention

Treat OIDC properties (ALLOWED_HOSTS) as code-only config, never in URLs.
Centralize auth-mechanism property parsing in a helper.
Audit URIs in logs to ensure no ALLOWED_HOSTS leak.

When it happens

Trigger: Using MONGODB-OIDC with a URI like 'mongodb+srv://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ALLOWED_HOSTS:example.com,TOKEN_AUDIENCE:...'. Any ALLOWED_HOSTS value in authMechanismProperties triggers this.

Common situations: Configuring OIDC against Azure AD or another identity provider; copy-pasting a provider sample that put ALLOWED_HOSTS in the connection string; upgrading the driver and hitting the newly-enforced restriction.

Related errors

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/03516672c8eb9e81.json. Report an issue: GitHub.