siyuan-note/siyuan · error · Error

--remote does not accept credentials in the URL

Error message

--remote does not accept credentials in the URL

What it means

normalizeRemoteKernelOrigin rejects --remote URLs that embed credentials (user:pass@host). The remote kernel connection flow manages authentication via its own login/storage clearing, so baked-in URL credentials are not allowed.

Source

Thrown at app/electron/remoteKernel.js:19

const crypto = require("node:crypto");

// 解析命令行参数时保留值中的等号，避免 URL 查询参数被截断。
const getArgFrom = (args, name) => {
    const prefix = name + "=";
    const arg = args.find((item) => item === name || item.startsWith(prefix));
    if (!arg) {
        return;
    }
    return arg === name ? "" : arg.slice(prefix.length);
};

const normalizeRemoteKernelOrigin = (value) => {
    if (!value) {
        throw new Error("--remote requires a URL");
    }
    const url = new URL(value);
    if (url.username || url.password) {
        throw new Error("--remote does not accept credentials in the URL");
    }
    if (url.pathname !== "/" || url.search || url.hash || value.includes("?") || value.includes("#")) {
        throw new Error("--remote only accepts an origin without a path, query, or fragment");
    }
    if (url.protocol !== "https:") {
        throw new Error("--remote requires HTTPS");
    }
    return url.origin;
};

const insecureCertificateSwitchNames = Object.freeze([
    "allow-insecure-localhost",
    "ignore-certificate-errors",
    "ignore-certificate-errors-spki-list",
    "ignore-ssl-errors",
    "ignore-ssl-errors-with-hosts",
]);
const insecureCertificateSwitches = new Set(insecureCertificateSwitchNames);

View on GitHub (pinned to 8641553a1f)

Solutions

  1. Strip the credentials and pass only the origin: https://host:6806
  2. If basic-auth protection is in front of the kernel, handle auth at the proxy/VPN layer or expose the kernel origin without inline credentials
  3. Use the app's own remote-kernel login screen for authentication instead of URL credentials
  4. If a token is required, configure it where the kernel/proxy expects it (header/auth page), not in the URL

Example fix

// before
//   --remote "https://user:secret@myhost:6806"
// after
//   --remote "https://myhost:6806"
Defensive patterns

Strategy: validation

Validate before calling

const u = new URL(candidate);
if (u.username || u.password) {
  throw new Error("strip credentials from the --remote URL");
}

Type guard

const hasNoInlineCredentials = (v) => { try { const u = new URL(v); return !u.username && !u.password; } catch { return false; } };

Try / catch

try {
  const origin = normalizeRemoteKernelOrigin(args.remote);
} catch (e) {
  if (e.message === "--remote does not accept credentials in the URL") {
    // sanitize: new URL(v).origin and re-invoke, prompting for login in-app
  }
}

Prevention

When it happens

Trigger: Calling normalizeRemoteKernelOrigin with a URL whose new URL(value) parse yields non-empty url.username or url.password — e.g. https://user:pass@host:6806 or https://user@host.

Common situations: Copy-pasting a URL from a reverse-proxy setup that uses HTTP basic auth; pasting credentials from a shared-link service; an old bookmark that included an inline token as the username.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/842858e0f4b4a4ed. Report an issue: GitHub.