santifer/career-ops · error · Error

nodesk: untrusted hostname

Error message

nodesk: untrusted hostname "${parsed.hostname}" - must be ${TRUSTED_HOST}

What it means

assertNodeskUrl pins the provider to a single trusted host (TRUSTED_HOST). After the URL parses and passes the HTTPS check, this error is thrown when parsed.hostname does not equal TRUSTED_HOST. This prevents the provider from being pointed at look-alike or third-party hosts (SSRF/open-redirect hardening).

Solutions

Correct the hostname to exactly match the trusted host (check for missing/extra subdomains and typos)
Copy a known-good URL from the provider's documentation or an existing working entry
If the entry belongs to another ATS/provider, move it to the matching provider config instead
If the trusted host itself changed upstream, update TRUSTED_HOST in providers/nodesk.mjs deliberately — do not bypass the assert

Example fix

// before
assertNodeskUrl('https://nodesk-mirror.example.net/jobs');
// after
assertNodeskUrl('https://' + TRUSTED_HOST + '/jobs');

Defensive patterns

Strategy: validation

Validate before calling

const parsed = new URL(url);
if (parsed.hostname !== 'nodesk.example') throw new Error(`wrong host: ${parsed.hostname}`);

Type guard

function isTrustedHost(u, trusted) {
  try { return new URL(u).hostname === trusted; } catch { return false; }
}

Try / catch

try {
  useNodesk(url);
} catch (e) {
  if (String(e.message).startsWith('nodesk: untrusted hostname')) {
    log.warn(`Entry points at wrong host, skipping: ${url}`);
    return null;
  }
  throw e;
}

Prevention

Copy provider URLs from a known-good working entry, not from memory
Keep one canonical TRUSTED_HOST constant and reference it when writing configs
Route each company entry to the provider that actually hosts its board
Watch for subdomain drift (www., api., regional prefixes) when editing hosts by hand

When it happens

Trigger: Calling the nodesk provider with a URL on a different domain — a mirror, a company careers page, a staging host, or a typo'd hostname like 'nodesk.example.com' or 'www.<trusted-host>' if that is not the pinned host.

Common situations: Config entry pointing at the wrong provider's URL (copy-paste across providers); subdomain added or removed ('api.' prefix); hostname changed after a vendor migration; typos in the host portion.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of santifer/career-ops@aac998c7ed (2026-09-16). Data as JSON: /api/errors/91274b60048cc9b0. Report an issue: GitHub.

Appendix: source

Thrown at providers/nodesk.mjs:25

// and XML, so it is parsed in-process with the same tiny tag extractor
// approach as providers/personio.mjs rather than adding an XML dependency.
//
// Wire in via a `job_boards:` entry with `provider: nodesk`.

const FEED_URL = 'https://nodesk.co/remote-jobs/index.xml';
const TRUSTED_HOST = 'nodesk.co';

/** @param {string} url */
function assertNodeskUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`nodesk: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`nodesk: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`nodesk: untrusted hostname "${parsed.hostname}" - must be ${TRUSTED_HOST}`);
  }
  return url;
}

// NaN-safe Date.parse - `|| undefined` would also coerce a valid epoch 0.
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

function fallbackCompany(entry) {
  return typeof entry?.name === 'string' && entry.name.trim() ? entry.name.trim() : 'NoDesk';
}

/** @type {Provider} */
export default {
  id: 'nodesk',

View on GitHub (pinned to aac998c7ed)