ratchetphp/Ratchet · error · UnexpectedValueException

Invalid domain

Error message

Invalid domain

What it means

FlashPolicy::addAllowedAccess() validates each domain string before adding it to the cross-domain policy it will render. When validateDomain() rejects the value it throws UnexpectedValueException('Invalid domain'). The validator only accepts domains matching a safe pattern (letters, digits, hyphens, dots, and '*' wildcards such as '*.example.com' or '*'), so URLs, ports embedded in the domain, protocols, or malformed wildcards are rejected.

Solutions

1. Pass only the bare hostname or wildcard pattern, e.g. 'example.com', '*.example.com', or '*', and move port configuration to the $ports argument.
2. Strip scheme and port before calling: parse the configured origin (parse_url) and pass only $parts['host'].
3. Validate the domain against the same shape in your own config layer (alphanumerics, hyphens, dots, leading '*.') so bad config fails early with a clearer message.
4. If access for arbitrary subdomains is needed, use '*.example.com' rather than inserting a wildcard mid-domain, which is not accepted.

Example fix

// before
$fp->addAllowedAccess('http://cdn.example.com:8443');

// after
$fp->addAllowedAccess('cdn.example.com', '8443');

function isValidFlashPolicyDomain(string $domain): bool {
    return (bool) preg_match('/^(\*|(\*\.)?([a-z0-9-]+\.)+[a-z0-9-]+)$/i', $domain);
}
$host = parse_url($origin, PHP_URL_HOST) ?? $origin;
if (!isValidFlashPolicyDomain($host)) { /* reject config before calling the library */ }

function isFlashDomain($domain): bool {
    return is_string($domain) && preg_match('/^(\*|(\*\.)?([a-z0-9-]+\.)+[a-z0-9-]+)$/i', $domain) === 1;
}

try {
    $fp->addAllowedAccess($domain, $ports);
} catch (\UnexpectedValueException $e) {
    if ($e->getMessage() === 'Invalid domain') {
        error_log("Rejecting invalid policy domain: {$domain}");
    } else { throw $e; }
}

When it happens

Trigger: Passing a URL like 'http://example.com' or 'example.com:8080' as $domain (scheme/port must go elsewhere); passing 'sub.*.example.com' or a bare '*' in an invalid position; passing an empty string or a value with spaces, underscores, or other characters outside the validator's pattern.

Common situations: Copy-pasting an origin URL from a browser instead of the bare hostname; trying to open a specific port by appending ':port' to the domain instead of using the $ports parameter; building the domain string dynamically from config where an empty or placeholder value slips through.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid Port
• Invalid site control set
• $request can not be null
• All routes must implement Ratchet\Http\HttpServerInterface
• Argument #4 ($loop) expected…

AI-assisted analysis of ratchetphp/Ratchet@e621c6c40b (2026-09-16). Data as JSON: /api/errors/805b92bba3375c8e. Report an issue: GitHub.

Appendix: source

Thrown at src/Ratchet/Server/FlashPolicy.php:62

    /**
     * Add a domain to an allowed access list.
     *
     * @param string $domain Specifies a requesting domain to be granted access. Both named domains and IP
     * addresses are acceptable values. Subdomains are considered different domains. A wildcard (*) can
     * be used to match all domains when used alone, or multiple domains (subdomains) when used as a
     * prefix for an explicit, second-level domain name separated with a dot (.)
     * @param string $ports A comma-separated list of ports or range of ports that a socket connection
     * is allowed to connect to. A range of ports is specified through a dash (-) between two port numbers.
     * Ranges can be used with individual ports when separated with a comma. A single wildcard (*) can
     * be used to allow all ports.
     * @param bool $secure
     * @throws \UnexpectedValueException
     * @return FlashPolicy
     */
    public function addAllowedAccess($domain, $ports = '*', $secure = false) {
        if (!$this->validateDomain($domain)) {
           throw new \UnexpectedValueException('Invalid domain');
        }

        if (!$this->validatePorts($ports)) {
           throw new \UnexpectedValueException('Invalid Port');
        }

        $this->_access[]   = array($domain, $ports, (bool)$secure);
        $this->_cacheValid = false;

        return $this;
    }
    
    /**
     * Removes all domains from the allowed access list.
     * 
     * @return \Ratchet\Server\FlashPolicy
     */
    public function clearAllowedAccess() {

View on GitHub (pinned to e621c6c40b)