phacility/phabricator · error · AphrontMalformedRequestException

This server is configured as "%s", but you are using the dom

Error message

This server is configured as "%s", but you are using the domain name "%s" to access a page which is trying to set a cookie. Access this service on the configured primary domain or a configured alternate domain. Cookies will not be set on other domains for security reasons.

What it means

Thrown by 'bin/repository thaw --all-repositories' when no repositories can be found on the device or service being promoted/demoted. In the '--all-repositories' branch the workflow resolves the target's Almanac services, then queries repositories bound to those services; if that chain yields nothing, there is nothing to thaw and the command stops. This usually points at an Almanac configuration issue rather than a typo, since a completely unknown device/service name fails earlier with a different error.

Source

Thrown at src/aphront/AphrontRequest.php:586

   * @param string  Cookie name.
   * @param string  Cookie value.
   * @param int     Epoch timestamp for cookie expiration.
   * @return this
   * @task cookie
   */
  private function setCookieWithExpiration(
    $name,
    $value,
    $expire) {

    $is_secure = false;

    $base_domain_uri = $this->getCookieDomainURI();
    if (!$base_domain_uri) {
      $configured_as = PhabricatorEnv::getEnvConfig('phabricator.base-uri');
      $accessed_as = $this->getHost();

      throw new AphrontMalformedRequestException(
        pht('Bad Host Header'),
        pht(
          'This server is configured as "%s", but you are using the domain '.
          'name "%s" to access a page which is trying to set a cookie. '.
          'Access this service on the configured primary domain or a '.
          'configured alternate domain. Cookies will not be set on other '.
          'domains for security reasons.',
          $configured_as,
          $accessed_as),
        true);
    }

    $base_domain = $base_domain_uri->getDomain();
    $is_secure = ($base_domain_uri->getProtocol() == 'https');

    $name = $this->getPrefixedCookieName($name);

    if (php_sapi_name() == 'cli') {

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Confirm in Almanac (or via the web UI) that the device has bindings to a repository service and that repositories are bound to that service.
2. Name the repositories explicitly instead of using '--all-repositories' to bypass the device-based lookup.
3. Verify you are operating on the correct Phabricator instance and device names (check AlmanacDevices in the web UI).

Example fix

# before
bin/repository thaw --demote dev-002 --all-repositories

# after (target the repositories explicitly)
bin/repository thaw --demote dev-002 R1 R2 R3

// Confirm the device actually hosts repositories before thaw:
$devices = id(new AlmanacDeviceQuery())->setViewer($viewer)->withNames(array($name))->execute();
$services = id(new AlmanacServiceQuery())->setViewer($viewer)
  ->withDevicePHIDs(mpull($devices, 'getPHID'))->execute();
$repos = id(new PhabricatorRepositoryQuery())->setViewer($viewer)
  ->withAlmanacServicePHIDs(mpull($services, 'getPHID'))->execute();
if (!$repos) { /* fix Almanac config or pick repos explicitly */ }

When it happens

Trigger: Running 'bin/repository thaw --demote dev-002 --all-repositories' where dev-002 exists but belongs to no service that hosts repositories: $services is empty (or the service query returns repositories => none), so $repositories stays empty and the guard at PhabricatorRepositoryManagementThawWorkflow.php:148 throws.

Common situations: Devices used only for other cluster roles (db, cache, web) mistakenly passed to thaw; repositories migrated off a service but the old device kept in runbooks; Almanac bindings deleted or disabled during a reconfiguration; wrong cluster/instance (dev vs prod Almanac) targeted.

Related errors

• This service is configured in cluster mode and the address t
• This request reached a site which requires HTTPS, but the re
• Request parameter "%s" is not formatted properly. Expected a
• Request parameter "%s" is not formatted properly. Expected a
• Invalid Request (CSRF)

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/97dd945bdfb79f40. Report an issue: GitHub.