sgl-project/sglang · error · ValueError

Invalid allowed media domain {domain!r}: ports are not suppo

Error message

Invalid allowed media domain {domain!r}: ports are not supported

What it means

An allowed-media-domains entry contains a colon after failing to parse as an IP address. Colons only legitimately appear in IPv6 literals (handled by ipaddress.ip_address) or as port separators; since the entry is not a valid IP, the colon must be a port, which the allowlist does not support (port-specific rules would be ambiguous with port-less fetches).

Source

Thrown at python/sglang/srt/utils/common.py:1539

    if not isinstance(domain, str):
        raise ValueError("allowed media domains must be strings")

    domain = domain.strip().rstrip(".")
    if not domain:
        raise ValueError("allowed media domains cannot be empty")
    if "://" in domain or any(char in domain for char in "/?#@"):
        raise ValueError(
            f"Invalid allowed media domain {domain!r}: provide a hostname only"
        )

    # Brackets are URL syntax, not part of an IPv6 hostname.
    if domain.startswith("[") and domain.endswith("]"):
        domain = domain[1:-1]
    try:
        return str(ipaddress.ip_address(domain))
    except ValueError:
        if ":" in domain:
            raise ValueError(
                f"Invalid allowed media domain {domain!r}: ports are not supported"
            )

    try:
        normalized = domain.encode("idna").decode("ascii").lower()
    except UnicodeError as e:
        raise ValueError(f"Invalid allowed media domain {domain!r}") from e
    if not normalized:
        raise ValueError("allowed media domains cannot be empty")
    return normalized


def configure_media_url_security(
    allowed_media_domains: Optional[Sequence[str]] = None,
    max_file_size_mb: int = _DEFAULT_MEDIA_URL_MAX_FILE_SIZE_MB,
) -> list[str]:
    """Configure process-wide safeguards for client-supplied media URLs.

View on GitHub (pinned to 0132848349)

Solutions

1. Drop the port: allow 'internal-artifacts.mycompany.com' (all ports on that host are then allowed)
2. If port restriction is a hard requirement, enforce it with a network-level proxy/firewall since the allowlist is host-only
3. Document the hostname-only format for operators

Example fix

# before
configure_media_url_security(allowed_media_domains=['minio.internal:9000'])
# after
configure_media_url_security(allowed_media_domains=['minio.internal'])

import ipaddress
for d in domains:
    if ':' in d:
        try: ipaddress.ip_address(d.strip('[]'))
        except ValueError: raise ConfigError(f'{d!r}: ports not supported; host only')

When it happens

Trigger: Passing 'example.com:8080' or 'https?blocked-host:443' style entries to configure_media_url_security; note IPv6 with brackets was already unwrapped, so '[::1]' succeeds, but '::1:80' fails here.

Common situations: Users include ports from an internal artifact-server URL (e.g. 'internal-artifacts.mycompany.com:9000') in the allowlist.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• allowed media domains must be strings
• Invalid allowed media domain {domain!r}: provide a hostname
• allowed media domains cannot be empty
• Invalid allowed media domain {domain!r}
• media_url_max_file_size_mb must be non-negative

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/0245d0ea2f161143. Report an issue: GitHub.