unable to parse allowed origin %q: allowed origins must be a

Error message

unable to parse allowed origin %q: allowed origins must be absolute URLs with http or https scheme

What it means

Returned by validateWebsocketOptions() when an allowed_origins entry parses as a URI but its scheme is not http or https (or it lacks an absolute form with a host). Startup is rejected since origin comparison in websocket cross-origin checks requires absolute http(s) URLs; the offending value is named by %q.

Source

Thrown at server/websocket.go:1143

	// If no port is defined, we don't care about other options
	if wo.Port == 0 {
		return nil
	}
	if !wsAllowedFIPS() {
		return fmt.Errorf("websocket: cannot be used in FIPS-140 mode when built with this Go version, use Go 1.26 or later")
	}
	// Enforce TLS... unless NoTLS is set to true.
	if wo.TLSConfig == nil && !wo.NoTLS {
		return errors.New("websocket requires TLS configuration")
	}
	// Make sure that allowed origins, if specified, can be parsed.
	for _, ao := range wo.AllowedOrigins {
		u, err := url.ParseRequestURI(ao)
		if err != nil {
			return fmt.Errorf("unable to parse allowed origin: %v", err)
		}
		if u.Scheme != "http" && u.Scheme != "https" {
			return fmt.Errorf("unable to parse allowed origin %q: allowed origins must be absolute URLs with http or https scheme", ao)
		}
		if u.Host == _EMPTY_ {
			return fmt.Errorf("unable to parse allowed origin %q: host is required", ao)
		}
		if _, _, err := wsGetHostAndPort(u.Scheme == "https", u.Host); err != nil {
			return fmt.Errorf("unable to parse allowed origin: %v", err)
		}
	}
	// If there is a NoAuthUser, we need to have Users defined and
	// the user to be present.
	if wo.NoAuthUser != _EMPTY_ {
		if err := validateNoAuthUser(o, wo.NoAuthUser); err != nil {
			return err
		}
	}
	// Token/Username not possible if there are users/nkeys
	if len(o.Users) > 0 || len(o.Nkeys) > 0 {
		if wo.Username != _EMPTY_ {

View on GitHub (pinned to 3a66a489d2)

Solutions

Rewrite the origin as an absolute URL, e.g. https://example.com
Remove scheme-relative or bare-host entries like example.com or //example.com
Only http and https schemes are accepted; drop ws:// or custom schemes

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at server/websocket.go:1143 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/3ac3c94f787e4ec9. Report an issue: GitHub.