sgl-project/sglang · error · ValueError

Invalid allowed media domain {domain!r}: provide a hostname

Error message

Invalid allowed media domain {domain!r}: provide a hostname only

What it means

An allowed-media-domains entry contained URL syntax characters — a scheme separator '://', or any of / ? # @ — indicating a URL or userinfo form was supplied instead of a bare hostname. The allowlist matches hostnames only, so paths, schemes, or user@host forms are rejected to keep matching unambiguous.

Source

Thrown at python/sglang/srt/utils/common.py:1528

_mm_http_session = threading.local()

_DEFAULT_MEDIA_URL_MAX_FILE_SIZE_MB = 64
_MAX_MEDIA_URL_REDIRECTS = 5
_MEDIA_URL_REDIRECT_STATUS_CODES = {301, 302, 303, 307, 308}
_allowed_media_domains: frozenset[str] = frozenset()
_media_url_max_file_size_bytes = _DEFAULT_MEDIA_URL_MAX_FILE_SIZE_MB * 1024 * 1024


def _normalize_media_domain(domain: str) -> str:
    if not isinstance(domain, str):
        raise ValueError("allowed media domains must be strings")

    domain = domain.strip().rstrip(".")
    if not domain:
        raise ValueError("allowed media domains cannot be empty")
    if "://" in domain or any(char in domain for char in "/?#@"):
        raise ValueError(
            f"Invalid allowed media domain {domain!r}: provide a hostname only"
        )

    # Brackets are URL syntax, not part of an IPv6 hostname.
    if domain.startswith("[") and domain.endswith("]"):
        domain = domain[1:-1]
    try:
        return str(ipaddress.ip_address(domain))
    except ValueError:
        if ":" in domain:
            raise ValueError(
                f"Invalid allowed media domain {domain!r}: ports are not supported"
            )

    try:
        normalized = domain.encode("idna").decode("ascii").lower()
    except UnicodeError as e:
        raise ValueError(f"Invalid allowed media domain {domain!r}") from e

View on GitHub (pinned to 0132848349)

Solutions

1. Provide only the hostname: 'example.com' instead of 'https://example.com/...'
2. If subdomains matter, list each hostname explicitly (matching is exact)
3. Add a startup lint that rejects entries containing '://' or /?#@

Example fix

# before
configure_media_url_security(allowed_media_domains=['https://cdn.example.com/img.png'])
# after
configure_media_url_security(allowed_media_domains=['cdn.example.com'])

BAD = set(':/?#@')
for d in domains:
    if '://' in d or any(c in d for c in BAD):
        raise ConfigError(f'{d!r}: hostname only, no scheme/path/userinfo')

When it happens

Trigger: Passing 'https://example.com/path', 'user@example.com', or 'example.com/img.png' as an allowlist entry to configure_media_url_security.

Common situations: Users paste full URLs into --allowed-media-domains instead of just the domain; config templating injects scheme prefixes.

Related errors

• allowed media domains must be strings
• Invalid allowed media domain {domain!r}: ports are not suppo
• allowed media domains cannot be empty
• Invalid allowed media domain {domain!r}
• media_url_max_file_size_mb must be non-negative

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/c4b1452fe683b3da. Report an issue: GitHub.