sgl-project/sglang · error · ValueError

Media URL domain is not allowed. Allowed domains: {sorted(_a

Error message

Media URL domain is not allowed. Allowed domains: {sorted(_allowed_media_domains)}; input domain: {hostname}

What it means

The media URL's scheme is valid http(s) but the (IDNA-normalized) hostname is not in the configured allowed-media-domains allowlist. SGLang enforces an egress allowlist on all remote media fetches to block SSRF; if the allowlist is non-empty, only listed exact hostnames may be fetched.

Source

Thrown at python/sglang/srt/utils/common.py:1582

        raise ValueError("media_url_max_file_size_mb must be non-negative")

    normalized_domains = sorted(
        {_normalize_media_domain(domain) for domain in allowed_media_domains or []}
    )
    global _allowed_media_domains, _media_url_max_file_size_bytes
    _allowed_media_domains = frozenset(normalized_domains)
    _media_url_max_file_size_bytes = max_file_size_mb * 1024 * 1024
    return normalized_domains


def _assert_media_url_allowed(url: str) -> None:
    parsed = urlparse(url)
    if parsed.scheme not in {"http", "https"} or parsed.hostname is None:
        raise ValueError(f"Invalid media URL: {url!r}")

    hostname = _normalize_media_domain(parsed.hostname)
    if _allowed_media_domains and hostname not in _allowed_media_domains:
        raise ValueError(
            "Media URL domain is not allowed. "
            f"Allowed domains: {sorted(_allowed_media_domains)}; "
            f"input domain: {hostname}"
        )


def download_remote_media(url: str, timeout: float) -> bytes:
    """Download one HTTP(S) media object under the configured URL policy.

    Redirects are followed manually so every destination is validated before
    a connection is made. The response is streamed to enforce both the total
    request deadline and the configured byte limit without first buffering an
    attacker-controlled body in memory.
    """

    if timeout <= 0:
        raise ValueError("media URL timeout must be positive")

View on GitHub (pinned to 0132848349)

Solutions

1. Add the exact hostname (e.g. 'cdn.other-host.com') to --allowed-media-domains and restart
2. Use the same hostname your payloads actually reference (check www vs apex)
3. Leave the allowlist empty to disable the restriction only if your threat model permits

Example fix

# before
python -m sglang.launch_server --allowed-media-domains huggingface.co  # request uses cdn-lfs.huggingface.co -> fails
# after
python -m sglang.launch_server --allowed-media-domains huggingface.co,cdn-lfs.huggingface.co

from urllib.parse import urlparse
host = urlparse(url).hostname or ''
if host.strip('.').lower() not in configured_allowlist:
    return error_response(f'media host {host} not allowed')

try:
    data = download_remote_media(url, timeout=30)
except ValueError as e:
    if 'not allowed' in str(e):
        return HTTPException(403, str(e))
    raise

When it happens

Trigger: Server started with --allowed-media-domains huggingface.co but a request references https://cdn.other-host.com/img.png; hostname comparison is exact after normalization (no automatic subdomain matching).

Common situations: Model card / dataset referencing a CDN not in the allowlist; forgetting that 'example.com' does not cover 'www.example.com'; redirect chains that land on unlisted hosts (redirect targets are re-checked).

Related errors

• allowed media domains must be strings
• Invalid allowed media domain {domain!r}: provide a hostname
• Invalid allowed media domain {domain!r}: ports are not suppo
• Invalid media URL: {url!r}
• Invalid media URL: {current_url!r}

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/07c1781fb119c173. Report an issue: GitHub.