transloadit/uppy · error · TypeError

Option corsOrigins cannot be "*". To disable security, pass…

Error message

Option corsOrigins cannot be "*". To disable security, pass true

What it means

corsOrigins: '*' is explicitly rejected because wildcard CORS is insecure for a server that handles OAuth tokens and file proxying. Companion asks you to pass true instead if you truly want to disable origin restriction.

Solutions

Replace '*' with the explicit list of allowed origins
If you deliberately want no origin check (e.g. internal tooling), pass corsOrigins: true

Example fix

// before
corsOrigins: '*'

// after
corsOrigins: ['https://app.example.com', 'https://staging.example.com']

Defensive patterns

Strategy: validation

Validate before calling

if (companionOptions.corsOrigins === '*') companionOptions.corsOrigins = true // if disabling security is intended

Type guard

null

Try / catch

null

Prevention

Never write corsOrigins: '*'
Use an explicit origin array or boolean true

When it happens

Trigger: Setting { corsOrigins: '*' } in companionOptions.

Common situations: Copy-pasting CORS configs from browser-era examples; attempting to allow all origins during local testing or behind a proxy.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of transloadit/uppy@5d4dedd02a (2026-08-28). Data as JSON: /api/errors/88e708f1c9a79bfa. Report an issue: GitHub.

Appendix: source

Thrown at packages/@uppy/companion/src/config/companion.ts:148

  if (uploadUrls == null || uploadUrls.length === 0) {
    if (process.env['NODE_ENV'] === 'production') {
      throw new Error('uploadUrls is required')
    }
    logger.error(
      'Running without uploadUrls is a security risk and Companion will refuse to start up when running in production (NODE_ENV=production)',
      'startup.uploadUrls',
    )
  }

  const { corsOrigins } = companionOptions
  if (corsOrigins == null) {
    throw new TypeError(
      'Option corsOrigins is required. To disable security, pass true',
    )
  }

  if (corsOrigins === '*') {
    throw new TypeError(
      'Option corsOrigins cannot be "*". To disable security, pass true',
    )
  }
}

View on GitHub (pinned to 5d4dedd02a)