santifer/career-ops · warning · Error

comeet: untrusted hostname "${parsed.hostname}" — must be ${

Error message

comeet: untrusted hostname "${parsed.hostname}" — must be ${COMEET_API_HOST}

What it means

Thrown by comeet's assertComeetUrl when the URL is valid https but its hostname is not exactly www.comeet.co (COMEET_API_HOST). Comeet's careers API lives on a single fixed origin, so the SSRF defence pins the hostname rather than allowing per-tenant subdomains. This is defense-in-depth: resolveApiUrl's isComeetApiUrl enforces the identical hostname check and returns null (→ error 165) first, so fetch() surfaces 165 rather than 163. Reachable via a direct assertComeetUrl call.

Source

Thrown at providers/comeet.mjs:38

  try {
    parsed = new URL(raw);
  } catch {
    return false;
  }
  return parsed.protocol === 'https:' && parsed.hostname === COMEET_API_HOST && parsed.pathname.startsWith('/careers-api/');
}

/** @param {string} url */
function assertComeetUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`comeet: invalid URL: ${redactToken(url)}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`comeet: URL must use HTTPS: ${redactToken(url)}`);
  if (parsed.hostname !== COMEET_API_HOST)
    throw new Error(`comeet: untrusted hostname "${parsed.hostname}" — must be ${COMEET_API_HOST}`);
  if (!parsed.pathname.startsWith('/careers-api/'))
    throw new Error(`comeet: URL path must be the careers-api endpoint: ${redactToken(url)}`);
  return url;
}

// Redact the per-tenant ?token= so neither the (informational, possibly-logged)
// DetectHit url nor a thrown validation error carries the secret. Best-effort:
// falls back to a regex strip when the value can't be parsed as a URL.
function redactToken(url) {
  try {
    const parsed = new URL(url);
    if (parsed.searchParams.has('token')) parsed.searchParams.set('token', 'REDACTED');
    return parsed.href;
  } catch {
    return typeof url === 'string' ? url.replace(/([?&]token=)[^&#]*/gi, '$1REDACTED') : url;
  }
}

View on GitHub (pinned to 9b17a8ac97)

Solutions

For direct calls, pass only https://www.comeet.co/careers-api/... URLs.
For fetch() use, ensure entry.api is on www.comeet.co (this shows as 165, same fix).
Do not attempt to point the comeet provider at a proxy or alternate host — the host is intentionally non-configurable.

Example fix

// before — wrong host (the branded page, not the API)
assertComeetUrl('https://www.comeet.com/careers-api/2.0/company/abc/positions?token=x');

// after — exact API host
assertComeetUrl('https://www.comeet.co/careers-api/2.0/company/abc/positions?token=x');

Defensive patterns

Strategy: validation

Validate before calling

const COMEET_API_HOST = 'www.comeet.co';
function isComeetHost(u) {
  try { return new URL(u).hostname === COMEET_API_HOST; } catch { return false; }
}

Type guard

function isOnComeetApiHost(u) {
  if (typeof u !== 'string' || !u) return false;
  try { return new URL(u).hostname === 'www.comeet.co'; } catch { return false; }
}

Try / catch

try { assertComeetUrl(url); }
catch (e) {
  if (/^comeet: untrusted hostname/.test(e.message)) { /* wrong host — do not follow redirects, skip */ }
  else throw e;
}

Prevention

The Comeet API host is a fixed origin (www.comeet.co) — never configurable.
Do not alias it to a proxy or alternate domain.
Through fetch() this is pre-empted by 165.

When it happens

Trigger: assertComeetUrl is called directly with an https URL on a different host (e.g. www.comeet.com, a tenant CNAME, or an attacker-controlled host). Through fetch(), a non-www.comeet.co entry fails isComeetApiUrl and reports as error 165.

Common situations: Confusing the branded www.comeet.com page with the API host www.comeet.co; a direct integration test pointing at a mock host; an attempted SSRF via a crafted api: value (which fetch() rejects as 165).

Related errors

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/2881fbc8e24e2687. Report an issue: GitHub.