sgl-project/sglang · error · ValueError

allowed media domains must be strings

Error message

allowed media domains must be strings

What it means

The media-URL allowlist normalizer (_normalize_media_domain) requires every entry in --allowed-media-domains to be a Python str. Passing a non-string (e.g. bytes, None, or a list element of another type) is rejected early because domain matching must be exact string comparison after normalization.

Source

Thrown at python/sglang/srt/utils/common.py:1522

    torch.manual_seed(seed)
    if torch.cuda.is_available():
        torch.cuda.manual_seed_all(seed)
    if torch.xpu.is_available():
        torch.xpu.manual_seed_all(seed)


_mm_http_session = threading.local()

_DEFAULT_MEDIA_URL_MAX_FILE_SIZE_MB = 64
_MAX_MEDIA_URL_REDIRECTS = 5
_MEDIA_URL_REDIRECT_STATUS_CODES = {301, 302, 303, 307, 308}
_allowed_media_domains: frozenset[str] = frozenset()
_media_url_max_file_size_bytes = _DEFAULT_MEDIA_URL_MAX_FILE_SIZE_MB * 1024 * 1024


def _normalize_media_domain(domain: str) -> str:
    if not isinstance(domain, str):
        raise ValueError("allowed media domains must be strings")

    domain = domain.strip().rstrip(".")
    if not domain:
        raise ValueError("allowed media domains cannot be empty")
    if "://" in domain or any(char in domain for char in "/?#@"):
        raise ValueError(
            f"Invalid allowed media domain {domain!r}: provide a hostname only"
        )

    # Brackets are URL syntax, not part of an IPv6 hostname.
    if domain.startswith("[") and domain.endswith("]"):
        domain = domain[1:-1]
    try:
        return str(ipaddress.ip_address(domain))
    except ValueError:
        if ":" in domain:
            raise ValueError(
                f"Invalid allowed media domain {domain!r}: ports are not supported"

View on GitHub (pinned to 0132848349)

Solutions

1. Coerce all entries to str before passing: [str(d) for d in domains if d]
2. Filter out None entries when building the allowlist from optional config
3. Validate the config schema at load time

Example fix

# before
configure_media_url_security(allowed_media_domains=[b'cdn.example.com'])
# after
configure_media_url_security(allowed_media_domains=['cdn.example.com'])

domains = [d for d in raw_domains if isinstance(d, str)]
if len(domains) != len(raw_domains):
    raise ConfigError('allowed_media_domains must all be strings')

def is_valid_domain_list(v) -> bool:
    return isinstance(v, (list, tuple)) and all(isinstance(d, str) and d.strip() for d in v)

When it happens

Trigger: configure_media_url_security(allowed_media_domains=[b'example.com', ...]) or passing a config value deserialized as bytes/None; also _assert_media_url_allowed hitting a parsed.hostname that is not a str (rare, malformed URL parse).

Common situations: Loading server config from JSON/YAML where domains come back as bytes or null; programmatic construction of the allowlist from untyped data.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• Invalid allowed media domain {domain!r}: provide a hostname
• Invalid allowed media domain {domain!r}: ports are not suppo
• allowed media domains cannot be empty
• Invalid allowed media domain {domain!r}
• media_url_max_file_size_mb must be non-negative

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/12926b6fcdf0c285. Report an issue: GitHub.