phacility/phabricator · warning · AphrontMalformedRequestException

This service is configured to operate in cluster mode, but %

Error message

This service is configured to operate in cluster mode, but %s is not defined in the request context. Your webserver configuration needs to forward %s to PHP so the software can reject requests received on external interfaces.

What it means

Thrown by 'bin/repository thaw' when the operator declines the 'DATA AT RISK' confirmation prompt. Because thaw discards working copy versions on demoted devices or other leaders on promote, the workflow prints a permanent-data-loss warning and asks 'Accept the possibility of permanent data loss?'; answering 'n' aborts cleanly via PhutilArgumentUsageException. No state was changed when this is thrown.

Source

Thrown at src/aphront/configuration/AphrontApplicationConfiguration.php:419

    // also have a public address like "51.23.95.16". Assuming the cluster
    // is configured on a range like "170.0.0.0/16", we want to reject the
    // requests received on the public interface.
    //
    // Ideally, nodes in a cluster should only be listening on internal
    // interfaces, but they may be configured in such a way that they also
    // listen on external interfaces, since this is easy to forget about or
    // get wrong. As a broad security measure, reject requests received on any
    // interfaces which aren't on the whitelist.

    $cluster_addresses = PhabricatorEnv::getEnvConfig('cluster.addresses');
    if ($cluster_addresses) {
      $server_addr = idx($_SERVER, 'SERVER_ADDR');
      if (!$server_addr) {
        if (php_sapi_name() == 'cli') {
          // This is a command line script (probably something like a unit
          // test) so it's fine that we don't have SERVER_ADDR defined.
        } else {
          throw new AphrontMalformedRequestException(
            pht('No %s', 'SERVER_ADDR'),
            pht(
              'This service is configured to operate in cluster mode, but '.
              '%s is not defined in the request context. Your webserver '.
              'configuration needs to forward %s to PHP so the software can '.
              'reject requests received on external interfaces.',
              'SERVER_ADDR',
              'SERVER_ADDR'));
        }
      } else {
        if (!PhabricatorEnv::isClusterAddress($server_addr)) {
          throw new AphrontMalformedRequestException(
            pht('External Interface'),
            pht(
              'This service is configured in cluster mode and the address '.
              'this request was received on ("%s") is not whitelisted as '.
              'a cluster address.',
              $server_addr));

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Re-run the command and answer 'y' to the prompt once you have verified which device holds the authoritative copy.
2. For automation, add '--force' after reviewing the risk, e.g. 'bin/repository thaw --demote db-001 R12 --force'.
3. If unsure which device has the newest version, inspect PhabricatorRepositoryWorkingCopyVersion rows first and only then confirm.

Example fix

# before (interactive, declined)
bin/repository thaw --demote db-001 R12
# -> Accept the possibility of permanent data loss? [y/N] n

# after (verified, non-interactive)
bin/repository thaw --demote db-001 R12 --force

# Automation: decide interactiveness explicitly
if [ "$CI" = "1" ]; then FORCE=--force; fi
bin/repository thaw --demote "$DEVICE" $REPOS $FORCE

try {
  // workflow invocation / exec of bin/repository thaw
} catch (PhutilArgumentUsageException $ex) {
  if (preg_match('/aborted/', $ex->getMessage())) { /* treat as clean cancel, exit 0 */ }
  throw $ex;
}

When it happens

Trigger: Running 'bin/repository thaw --demote db-001 R12' without '--force' and answering 'n' (or sending EOF/no TTY in automation, where phutil_console_confirm fails as a declined prompt) at line 187.

Common situations: Interactive recovery sessions where the operator hesitates after seeing the DATA AT RISK banner; cron/CI jobs invoking thaw without '--force' so the prompt reads EOF from stdin and aborts; operators testing what thaw would do.

Related errors

• Request parameter "%s" is not formatted properly. Expected a
• Request parameter "%s" is not formatted properly. Expected a
• This server is configured as "%s", but you are using the dom
• This service is configured in cluster mode and the address t
• This request reached a site which requires HTTPS, but the re

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/b1764168776805a9. Report an issue: GitHub.