santifer/career-ops · error · Error

wttj: untrusted ${label} hostname "${parsed.hostname}" — mus

Error message

wttj: untrusted ${label} hostname "${parsed.hostname}" — must be ${host}

What it means

SSRF guard: the hostname does not match the expected host. For the env URL the expected host is www.welcometothejungle.com; for Algolia queries it is the derived ${appId}-dsn.algolia.net. The Algolia case can legitimately fire if WTTJ changes how it routes Algolia (different domain or suffix).

Source

Thrown at providers/wttj.mjs:42

// salary_filter can gate on it.

const ENV_URL = 'https://www.welcometothejungle.com/api/env';
const SITE_ORIGIN = 'https://www.welcometothejungle.com';
const INDEX = 'wttj_jobs_production_en';
const DEFAULT_MAX_HITS = 100;
const MAX_HITS_CAP = 200;

/** Pin a URL to an expected https host. */
function assertHost(url, host, label) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`wttj: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`wttj: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== host.toLowerCase()) {
    throw new Error(`wttj: untrusted ${label} hostname "${parsed.hostname}" — must be ${host}`);
  }
  return url;
}

/**
 * Parse the `window.env = {...}` payload served by /api/env and extract the
 * Algolia application id + client search key.
 * @param {string} text
 * @returns {{ appId: string, apiKey: string }}
 */
export function parseEnvPayload(text) {
  const start = text.indexOf('{');
  const end = text.lastIndexOf('}');
  if (start === -1 || end <= start) throw new Error('wttj: /api/env payload has no JSON object');
  let env;
  try {
    env = JSON.parse(text.slice(start, end + 1));
  } catch {

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Confirm ENV_URL host is www.welcometothejungle.com.
2. For Algolia host mismatches, inspect the appId parsed from /api/env and verify WTTJ still routes via ${appId}-dsn.algolia.net; update the host construction if WTTJ changed routing.
3. Re-fetch /api/env to confirm credentials are still valid.

Example fix

// if WTTJ moves to a regional Algolia host:
// before
const algoliaHost = `${appId}-dsn.algolia.net`;
// after
const algoliaHost = `${appId}-dsn.algolia.eu`;

if (new URL(ENV_URL).hostname !== "www.welcometothejungle.com")
  throw new Error("wttj: ENV_URL hostname drift");
if (new URL(`https://${algoliaHost}/`).hostname !== algoliaHost)
  throw new Error("wttj: derived Algolia host mismatch");

const matchesExpectedHost = (url, host) => { try { return new URL(url).hostname === host.toLowerCase(); } catch { return false; } };

When it happens

Trigger: ENV_URL constant pointed at a different host; OR WTTJ rotated its Algolia routing so the actual Algolia host no longer matches ${appId}-dsn.algolia.net; OR the appId regex matched a value that does not correspond to a real Algolia app id.

Common situations: WTTJ migrates Algolia hosts (e.g. a regional domain or a different -dsn suffix); a maintainer edits ENV_URL host.

Related errors

• weworkremotely: untrusted hostname "${parsed.hostname}" - mu
• workable: untrusted hostname "${parsed.hostname}" — must be
• wttj: invalid URL: ${url}
• wttj: URL must use HTTPS: ${url}
• a16z-speedrun-talent: invalid URL: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/f6873f68ae0d3dde. Report an issue: GitHub.