transloadit/uppy · critical · TypeError

Option corsOrigins is required. To disable security, pass tr

Error message

Option corsOrigins is required. To disable security, pass true

What it means

Companion requires the corsOrigins option to be set (an array of allowed origins or true to disable the check). Passing null/undefined throws a TypeError at startup because CORS handling must be explicit.

Source

Thrown at packages/@uppy/companion/src/config/companion.ts:142

          `The Provider option "providerOptions.${deprecated}" is no longer supported. Please use the option "${deprecatedOptions[deprecated]}" instead.`,
        )
      }
    })
  }

  if (uploadUrls == null || uploadUrls.length === 0) {
    if (process.env['NODE_ENV'] === 'production') {
      throw new Error('uploadUrls is required')
    }
    logger.error(
      'Running without uploadUrls is a security risk and Companion will refuse to start up when running in production (NODE_ENV=production)',
      'startup.uploadUrls',
    )
  }

  const { corsOrigins } = companionOptions
  if (corsOrigins == null) {
    throw new TypeError(
      'Option corsOrigins is required. To disable security, pass true',
    )
  }

  if (corsOrigins === '*') {
    throw new TypeError(
      'Option corsOrigins cannot be "*". To disable security, pass true',
    )
  }
}

View on GitHub (pinned to 5d4dedd02a)

Solutions

1. Add corsOrigins: ['https://your-app.example.com'] to companionOptions
2. Pass corsOrigins: true only in trusted/testing environments to disable the check
3. Never pass '*' — use the array form or true

Example fix

// before
companion.app({ ...opts })

// after
companion.app({ ...opts, corsOrigins: ['https://app.example.com'] })

if (companionOptions.corsOrigins == null) throw new TypeError('corsOrigins required')

const hasCorsOrigins = (o: { corsOrigins?: string[] | boolean }) => o.corsOrigins != null

null

When it happens

Trigger: Starting Companion whose config has no corsOrigins key (e.g. constructed from partial objects or env vars that were undefined).

Common situations: Upgrading to a Companion version that made corsOrigins mandatory; building config dynamically where corsOrigins ends up undefined.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• If you want to use '/' as server.path, leave the 'path' vari
• uploadUrls is required
• Option corsOrigins cannot be "*". To disable security, pass
• Missing S3 object key for completing multipart upload
• [s3mini] fileType must be a string

AI-assisted analysis of transloadit/uppy@5d4dedd02a (2026-08-28). Data as JSON: /api/errors/fdc1a48531227df3. Report an issue: GitHub.