seanmonstar/warp · error

invalid Origin

Error message

invalid Origin

What it means

After splitting an origin string on "://", warp calls `Origin::try_from_parts(scheme, rest, None)` and `.expect("invalid Origin")` (src/filters/cors.rs:620). This panics when the scheme exists but the authority part is not a valid origin — e.g. it contains a path, invalid characters, or an unusable port. It is an unrecoverable programmer/config error by design: warp treats a malformed allow-origin entry as a startup-time bug.

Solutions

1. Use bare `scheme://host[:port]` with no path, query, or trailing slash: "https://example.com"
2. For any-origin access use `warp::cors().allow_any_origin()` instead of a wildcard string
3. Validate the origin by parsing it (e.g. check `url.origin()` equivalent: scheme + host + optional port only) before registering
4. Switch to `allow_origin_fn` for pattern matching (subdomains) rather than encoding wildcards in the string

Example fix

// before
let cors = warp::cors().allow_origin("https://example.com/api");
// after
let cors = warp::cors().allow_origin("https://example.com");

fn validate_origin(s: &str) -> Result<(), String> {
    let (scheme, rest) = s.split_once("://").ok_or("missing scheme")?;
    if rest.is_empty() || rest.contains('/') || rest.contains('?') || rest.contains('#') {
        return Err(format!("'{}' is not a bare origin (scheme://host[:port] only)", s));
    }
    Ok(())
}

fn is_bare_origin(s: &str) -> bool {
    s.split_once("://").map_or(false, |(_, rest)| !rest.is_empty() && !rest.contains(['/','?','#']))
}

When it happens

Trigger: `warp::cors().allow_origin(..)` with strings like "https://example.com/path" (origin must not include a path), "https://" (empty authority), origins with spaces, wildcard entries expressed as "https://*" where `try_from_parts` rejects them, or IPv6 hosts written unbracketed.

Common situations: Users pasting full URLs with paths from a browser address bar into CORS config; hand-edited config adding trailing slashes; attempting to use "null" or wildcard syntax in the wrong form; building origins dynamically with string concatenation and leaving stray segments.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• illegal Method
• illegal Header
• Origin is always a valid HeaderValue
• missing scheme
• invalid host/authority

AI-assisted analysis of seanmonstar/warp@ff34d7213e (2026-09-09). Data as JSON: /api/errors/ef6460f47275ee07. Report an issue: GitHub.

Appendix: source

Thrown at src/filters/cors.rs:620

    }

    impl Seconds for ::std::time::Duration {
        fn seconds(self) -> u64 {
            self.as_secs()
        }
    }

    pub trait IntoOrigin {
        fn into_origin(self) -> Origin;
    }

    impl<'a> IntoOrigin for &'a str {
        fn into_origin(self) -> Origin {
            let mut parts = self.splitn(2, "://");
            let scheme = parts.next().expect("missing scheme");
            let rest = parts.next().expect("missing scheme");

            Origin::try_from_parts(scheme, rest, None).expect("invalid Origin")
        }
    }
}

View on GitHub (pinned to ff34d7213e)