remix-run/remix · error · Error

invalid origin ${JSON.stringify(origin)}: trailing slash is

Error message

invalid origin ${JSON.stringify(origin)}: trailing slash is not allowed

What it means

Origins are compared as scheme://host strings, so a trailing '/' is rejected — 'https://x.com/' would never equal the serialized request Origin header and would silently fail to match.

Source

Thrown at packages/cop-middleware/src/lib/cop.ts:181

function getHeaderValue(headers: Headers, name: string): string | null {
  let value = headers.get(name)
  if (value == null) {
    return null
  }

  let trimmedValue = value.trim()
  return trimmedValue === '' ? null : trimmedValue
}

function validateTrustedOrigin(origin: string): string {
  let trimmedOrigin = origin.trim()
  if (trimmedOrigin === '') {
    throw new Error('trusted origin must not be empty')
  }

  if (trimmedOrigin.endsWith('/')) {
    throw new Error(`invalid origin ${JSON.stringify(origin)}: trailing slash is not allowed`)
  }

  let parsedOrigin = parseOrigin(trimmedOrigin)
  if (parsedOrigin == null) {
    throw new Error(`invalid origin ${JSON.stringify(origin)}`)
  }

  if (parsedOrigin.pathname !== '/' || parsedOrigin.search !== '' || parsedOrigin.hash !== '') {
    throw new Error(
      `invalid origin ${JSON.stringify(origin)}: path, query, and fragment are not allowed`,
    )
  }

  return serializeOrigin(parsedOrigin)
}

function normalizeOrigin(origin: string): string | null {
  let parsedOrigin = parseOrigin(origin)

View on GitHub (pinned to 9696913134)

Solutions

1. Remove the trailing slash: 'https://api.example.com'
2. Strip it programmatically: `origin.replace(/\/+$/, '')` before adding
3. Use a dedicated origin constant rather than a base-url variable

Example fix

// before
cop.addTrustedOrigin('https://api.example.com/')
// after
cop.addTrustedOrigin('https://api.example.com')

cop.addTrustedOrigin(origin.replace(/\/+$/, ''))

When it happens

Trigger: addTrustedOrigin('https://api.example.com/') — any origin string ending with '/'.

Common situations: Copy-pasting a site URL (which includes the slash) from a browser bar into config; building origins by concatenating a base URL variable that ends in '/'.

Related errors

• invalid origin ${JSON.stringify(origin)}
• invalid origin ${JSON.stringify(origin)}: path, query, and f
• trusted origin must not be empty
• mounts keys must be URL pathnames without query strings, fra
• Resolved path escapes the allowed root: ${relativePath}

AI-assisted analysis of remix-run/remix@9696913134 (2026-08-27). Data as JSON: /api/errors/d631e084dd1e6d01. Report an issue: GitHub.