tursodatabase/turso · error · InvalidOperationException

Refusing to send the sync auth token to an origin other than

Error message

Refusing to send the sync auth token to an origin other than the configured remote.

What it means

This InvalidOperationException is thrown by ValidateAuthTransport before an HTTP sync request is sent. If an AuthToken is configured, the library refuses to attach it to any request whose URI origin (scheme, host, port) differs from the configured remote origin, preventing credential leakage to third-party endpoints such as redirects or redirect-target rewrites.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoSyncDatabase.cs:761

            if (_disposeHttpClient)
                _httpClient.Dispose();
        }
        finally
        {
            _operationLock.Release();
        }
    }

    internal static void ValidateAuthTransport(
        Uri requestUri,
        Uri configuredRemoteUri,
        string? authToken)
    {
        if (string.IsNullOrWhiteSpace(authToken))
            return;
        if (!HasSameOrigin(requestUri, configuredRemoteUri))
        {
            throw new InvalidOperationException(
                "Refusing to send the sync auth token to an origin other than the configured remote.");
        }
        if (requestUri.Scheme != Uri.UriSchemeHttps && !requestUri.IsLoopback)
        {
            throw new InvalidOperationException(
                "Auth Token requires HTTPS sync requests unless the host is localhost or loopback.");
        }
    }

    private static bool HasSameOrigin(Uri left, Uri right)
    {
        return left.Scheme.Equals(right.Scheme, StringComparison.OrdinalIgnoreCase)
               && left.IdnHost.Equals(right.IdnHost, StringComparison.OrdinalIgnoreCase)
               && left.Port == right.Port;
    }

    private static Uri NormalizeRemoteUri(Uri uri)
    {

View on GitHub (pinned to 6c72522679)

Solutions

1. Ensure the sync remote never redirects to a different origin; configure the canonical origin (scheme+host+port) as the remoteUri
2. Remove the AuthToken if you intentionally need to talk to a non-configured origin, and use a different auth mechanism
3. Use a HttpClient handler that disables automatic cross-origin redirect following (AllowAutoRedirect=false) and handle redirects explicitly
4. Verify the request URL construction: the effective request URI must match the scheme, host, and port of the remote passed to TursoSyncDatabaseOptions

Example fix

// before: handler follows redirects, token leaks to redirect target
var client = new HttpClient(new SocketsHttpHandler { AllowAutoRedirect = true });
var db = new TursoSyncDatabase(new TursoSyncDatabaseOptions(path, remote) { AuthToken = token, HttpClient = client });
// after: disable redirects so requests never go to a different origin
var client = new HttpClient(new SocketsHttpHandler { AllowAutoRedirect = false });
var db = new TursoSyncDatabase(new TursoSyncDatabaseOptions(path, remote) { AuthToken = token, HttpClient = client });

bool TokenTransportIsSafe(Uri requestUri, Uri configuredRemote, string? authToken) =>
    string.IsNullOrWhiteSpace(authToken) ||
    (requestUri.Scheme == configuredRemote.Scheme && requestUri.Host == configuredRemote.Host && requestUri.Port == configuredRemote.Port);
var handler = new SocketsHttpHandler { AllowAutoRedirect = false };
var client = new HttpClient(handler);

try
{
    await db.SyncAsync(ct);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("Refusing to send the sync auth token"))
{
    logger.LogError(ex, "Sync attempted to send auth token to a different origin than the configured remote.");
    throw; // do not retry with credentials at risk
}

When it happens

Trigger: Calling sync operations on a TursoSyncDatabase with an AuthToken set while HandleHttpCoreAsync is about to issue a request whose requestUri has a different origin than configuredRemoteUri (e.g. after a redirect, a rewritten base URL, or pointing the request at a mirror/proxy host).

Common situations: Server-side redirects from the configured remote to a different host (CDN, load balancer) that the client follows with the token attached; misconfigured remote URLs pointing to a proxy while requests are redirected elsewhere; custom HttpClient handlers that rewrite request URLs.

Related errors

• Auth Token requires an HTTPS sync URL unless the host is loc
• Auth Token requires HTTPS sync requests unless the host is l
• Use AuthToken instead of embedding credentials in the sync U
• Auth Token requires an HTTPS remote Turso URL unless the hos
• Automatic sync is not supported for embedded replica connect

AI-assisted analysis of tursodatabase/turso@6c72522679 (2026-08-31). Data as JSON: /api/errors/dc3cd44afcb11f0e. Report an issue: GitHub.