remix-run/remix · error · Error

invalid origin ${JSON.stringify(origin)}: path, query, and f

Error message

invalid origin ${JSON.stringify(origin)}: path, query, and fragment are not allowed

What it means

A trusted origin must be exactly scheme://host — no path, query string, or fragment. Including any of these component makes the value not an origin, so it is rejected with this message.

Source

Thrown at packages/cop-middleware/src/lib/cop.ts:190

}

function validateTrustedOrigin(origin: string): string {
  let trimmedOrigin = origin.trim()
  if (trimmedOrigin === '') {
    throw new Error('trusted origin must not be empty')
  }

  if (trimmedOrigin.endsWith('/')) {
    throw new Error(`invalid origin ${JSON.stringify(origin)}: trailing slash is not allowed`)
  }

  let parsedOrigin = parseOrigin(trimmedOrigin)
  if (parsedOrigin == null) {
    throw new Error(`invalid origin ${JSON.stringify(origin)}`)
  }

  if (parsedOrigin.pathname !== '/' || parsedOrigin.search !== '' || parsedOrigin.hash !== '') {
    throw new Error(
      `invalid origin ${JSON.stringify(origin)}: path, query, and fragment are not allowed`,
    )
  }

  return serializeOrigin(parsedOrigin)
}

function normalizeOrigin(origin: string): string | null {
  let parsedOrigin = parseOrigin(origin)
  return parsedOrigin == null ? null : serializeOrigin(parsedOrigin)
}

function parseOrigin(origin: string): URL | null {
  try {
    let parsedOrigin = new URL(origin)
    if (parsedOrigin.host === '') {
      return null
    }

View on GitHub (pinned to 9696913134)

Solutions

1. Trim the value to scheme://host, e.g. 'https://example.com'
2. Use addInsecureBypassPattern('GET /api/*') for path-scoped exceptions instead of encoding paths in origins
3. Document in config examples that origins are scheme+host only

Example fix

// before
cop.addTrustedOrigin('https://example.com/api')
// after
cop.addTrustedOrigin('https://example.com')
cop.addInsecureBypassPattern('GET /api/*')

let u = new URL(origin)
if (u.pathname !== '/' || u.search || u.hash) throw new Error('origin must be scheme://host')
// or strip: cop.addTrustedOrigin(`${u.protocol}//${u.host}`)

When it happens

Trigger: addTrustedOrigin('https://example.com/api'), 'https://example.com?token=1', or 'https://example.com#section'.

Common situations: Trusting a specific API endpoint URL instead of its origin; copy-pasting deep links; scoping trust with path patterns (not supported — use bypass patterns for path-scoped rules).

Related errors

• invalid origin ${JSON.stringify(origin)}: trailing slash is
• invalid origin ${JSON.stringify(origin)}
• trusted origin must not be empty
• mounts keys must be URL pathnames without query strings, fra
• Resolved path escapes the allowed root: ${relativePath}

AI-assisted analysis of remix-run/remix@9696913134 (2026-08-27). Data as JSON: /api/errors/3fae88c552dd45ff. Report an issue: GitHub.