transloadit/uppy · error · TypeError

Option corsOrigins cannot be "*". To disable security, pass

Error message

Option corsOrigins cannot be "*". To disable security, pass true

What it means

corsOrigins: '*' is explicitly rejected because wildcard CORS is insecure for a server that handles OAuth tokens and file proxying. Companion asks you to pass true instead if you truly want to disable origin restriction.

Source

Thrown at packages/@uppy/companion/src/config/companion.ts:148

  if (uploadUrls == null || uploadUrls.length === 0) {
    if (process.env['NODE_ENV'] === 'production') {
      throw new Error('uploadUrls is required')
    }
    logger.error(
      'Running without uploadUrls is a security risk and Companion will refuse to start up when running in production (NODE_ENV=production)',
      'startup.uploadUrls',
    )
  }

  const { corsOrigins } = companionOptions
  if (corsOrigins == null) {
    throw new TypeError(
      'Option corsOrigins is required. To disable security, pass true',
    )
  }

  if (corsOrigins === '*') {
    throw new TypeError(
      'Option corsOrigins cannot be "*". To disable security, pass true',
    )
  }
}

View on GitHub (pinned to 5d4dedd02a)

Solutions

1. Replace '*' with the explicit list of allowed origins
2. If you deliberately want no origin check (e.g. internal tooling), pass corsOrigins: true

Example fix

// before
corsOrigins: '*'

// after
corsOrigins: ['https://app.example.com', 'https://staging.example.com']

if (companionOptions.corsOrigins === '*') companionOptions.corsOrigins = true // if disabling security is intended

null

null

When it happens

Trigger: Setting { corsOrigins: '*' } in companionOptions.

Common situations: Copy-pasting CORS configs from browser-era examples; attempting to allow all origins during local testing or behind a proxy.

Understand the failure class

Background: "Invalid configuration value" and "Unsupported/Unknown setting value" errors: why libraries reject your config strings, numbers, and types — this error's family across 30 libraries.

Related errors

• uploadUrls is required
• Option corsOrigins is required. To disable security, pass tr
• Missing S3 object key for completing multipart upload
• [s3mini] fileType must be a string
• If you want to use '/' as server.path, leave the 'path' vari

AI-assisted analysis of transloadit/uppy@5d4dedd02a (2026-08-28). Data as JSON: /api/errors/88e708f1c9a79bfa. Report an issue: GitHub.