remix-run/remix · error · Error

trusted origin must not be empty

Error message

trusted origin must not be empty

What it means

The COP (cross-origin policy) middleware validates each trusted origin; after trimming, an empty string is rejected because an empty origin is never a meaningful trust grant.

Source

Thrown at packages/cop-middleware/src/lib/cop.ts:177

  }

  return 'Forbidden: cross-origin request detected, and/or browser is out of date: Sec-Fetch-Site is missing, and Origin does not match Host'
}

function getHeaderValue(headers: Headers, name: string): string | null {
  let value = headers.get(name)
  if (value == null) {
    return null
  }

  let trimmedValue = value.trim()
  return trimmedValue === '' ? null : trimmedValue
}

function validateTrustedOrigin(origin: string): string {
  let trimmedOrigin = origin.trim()
  if (trimmedOrigin === '') {
    throw new Error('trusted origin must not be empty')
  }

  if (trimmedOrigin.endsWith('/')) {
    throw new Error(`invalid origin ${JSON.stringify(origin)}: trailing slash is not allowed`)
  }

  let parsedOrigin = parseOrigin(trimmedOrigin)
  if (parsedOrigin == null) {
    throw new Error(`invalid origin ${JSON.stringify(origin)}`)
  }

  if (parsedOrigin.pathname !== '/' || parsedOrigin.search !== '' || parsedOrigin.hash !== '') {
    throw new Error(
      `invalid origin ${JSON.stringify(origin)}: path, query, and fragment are not allowed`,
    )
  }

  return serializeOrigin(parsedOrigin)

View on GitHub (pinned to 9696913134)

Solutions

1. Skip empty values before adding: filter origins with `.filter(o => o.trim() !== '')`
2. Set the env var to the full origin (e.g. https://api.example.com)
3. Default to a real origin instead of '' when the env var is missing

Example fix

// before
cop.addTrustedOrigin(process.env.TRUSTED_ORIGIN ?? '')
// after
let origin = process.env.TRUSTED_ORIGIN
if (origin) cop.addTrustedOrigin(origin)

origins.filter(o => o.trim() !== '').forEach(o => cop.addTrustedOrigin(o))

function isNonEmptyString(v: unknown): v is string {
  return typeof v === 'string' && v.trim() !== ''
}

When it happens

Trigger: Calling addTrustedOrigin('') or a whitespace-only string such as ' ', or configuration that reads an unset env var into the origins list.

Common situations: `addTrustedOrigin(process.env.TRUSTED_ORIGIN ?? '')` when the var is unset; looping over a config array that contains an empty entry; copy-paste placeholders left in config.

Related errors

• invalid origin ${JSON.stringify(origin)}: trailing slash is
• invalid origin ${JSON.stringify(origin)}
• invalid origin ${JSON.stringify(origin)}: path, query, and f
• invalid request method in bypass pattern ${JSON.stringify(pa
• invalid bypass pattern ${JSON.stringify(pattern)}: path must

AI-assisted analysis of remix-run/remix@9696913134 (2026-08-27). Data as JSON: /api/errors/337fe09b310fd3cf. Report an issue: GitHub.