mongodb/node-mongodb-native · error · MongoInvalidArgumentError

Host '${host}' is not valid for OIDC authentication with ALL

Error message

Host '${host}' is not valid for OIDC authentication with ALLOWED_HOSTS of '${allowedHosts.join(',')}'

What it means

Thrown during MongoClient connect when MONGODB-OIDC authentication is configured and a target host is not in the ALLOWED_HOSTS list (defaults to localhost and MongoDB Atlas/Cloud hosts). This guard prevents OIDC token theft by ensuring tokens are only sent to approved hosts. The error lists the offending host and the current ALLOWED_HOSTS for diagnosis. Skipped when a service ENVIRONMENT is configured (machine-to-machine).

Source

Thrown at src/mongo_client.ts:662

    }
    if (typeof options.srvHost === 'string') {
      const hosts = await resolveSRVRecord(options);

      for (const [index, host] of hosts.entries()) {
        options.hosts[index] = host;
      }
    }

    // It is important to perform validation of hosts AFTER SRV resolution, to check the real hostname,
    // but BEFORE we even attempt connecting with a potentially not allowed hostname
    if (options.credentials?.mechanism === AuthMechanism.MONGODB_OIDC) {
      const allowedHosts =
        options.credentials?.mechanismProperties?.ALLOWED_HOSTS || DEFAULT_ALLOWED_HOSTS;
      const isServiceAuth = !!options.credentials?.mechanismProperties?.ENVIRONMENT;
      if (!isServiceAuth) {
        for (const host of options.hosts) {
          if (!hostMatchesWildcards(host.toHostPort().host, allowedHosts)) {
            throw new MongoInvalidArgumentError(
              `Host '${host}' is not valid for OIDC authentication with ALLOWED_HOSTS of '${allowedHosts.join(
                ','
              )}'`
            );
          }
        }
      }
    }

    this.topology = new Topology(this, options.hosts, options);
    // Events can be emitted before initialization is complete so we have to
    // save the reference to the topology on the client ASAP if the event handlers need to access it

    this.topology.once(Topology.OPEN, () => this.emit('open', this));

    for (const event of MONGO_CLIENT_EVENTS) {
      this.topology.on(event, (...args: any[]) => this.emit(event, ...(args as any)));
    }

View on GitHub (pinned to 3366c21a63)

Solutions

  1. Add the host to ALLOWED_HOSTS via authMechanismProperties in the connection string: ?authMechanismProperties=ALLOWED_HOSTS:myhost.example.com,*.mydomain.com
  2. Verify the connection string host matches an entry (supports * wildcards) in ALLOWED_HOSTS.
  3. For non-interactive service auth, set ENVIRONMENT (e.g. aws, gcp, azure) which bypasses the host check.

Example fix

// before
const uri = 'mongodb://user@db.internal.corp:27017/?authMechanism=MONGODB-OIDC';

// after
const uri =
  'mongodb://user@db.internal.corp:27017/?authMechanism=MONGODB-OIDC' +
  '&authMechanismProperties=ALLOWED_HOSTS:db.internal.corp,*.internal.corp';
Defensive patterns

Strategy: validation

Validate before calling

function validateOidcHosts(hosts, allowedHosts) {
  const ok = hosts.every(h =>
    allowedHosts.some(pattern => hostMatchesWildcards(h, [pattern]))
  );
  if (!ok) throw new Error('Host not in ALLOWED_HOSTS');
}

Try / catch

try { await client.connect(); } catch (e) {
  if (e instanceof MongoInvalidArgumentError && /ALLOWED_HOSTS/.test(e.message)) {
    // fix connection string and retry
  }
  throw e;
}

Prevention

When it happens

Trigger: Connecting to a host not matching any wildcard in ALLOWED_HOSTS while using authMechanism=MONGODB-OIDC and no ENVIRONMENT. Connecting through a proxy or custom domain, or pointing at an on-prem host not added to ALLOWED_HOSTS.

Common situations: Self-hosted MongoDB with OIDC where the hostname was not allowlisted; typos in the connection string host; SRV records resolving to unexpected hosts; forgetting to set ALLOWED_HOSTS for non-Atlas deployments.

Related errors

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/78f1d195b52a8640.json. Report an issue: GitHub.