vllm-project/vllm · error

invalid --allowed-origins value {origin:?}: {e}

Error message

invalid --allowed-origins value {origin:?}: {e}

What it means

This anyhow error is produced by CorsConfig::validate() when a non-wildcard --allowed-origins value fails to parse as an http::HeaderValue (e.g. contains illegal characters like spaces, control bytes, or non-ASCII). Validation runs at startup so the CORS layer can be built infallibly afterwards. Wildcard "*" is exempt from parsing.

Source

Thrown at rust/src/server/src/config.rs:88

impl Default for CorsConfig {
    fn default() -> Self {
        Self {
            allow_origins: vec!["*".to_string()],
            allow_methods: vec!["*".to_string()],
            allow_headers: vec!["*".to_string()],
            allow_credentials: false,
        }
    }
}

impl CorsConfig {
    /// Validate that non-wildcard values parse into HTTP types, so the CORS
    /// layer can be built infallibly after startup validation has run.
    pub fn validate(&self) -> Result<()> {
        for origin in &self.allow_origins {
            if origin != "*" {
                origin.parse::<HeaderValue>().map_err(|e| {
                    anyhow::anyhow!("invalid --allowed-origins value {origin:?}: {e}")
                })?;
            }
        }
        for method in &self.allow_methods {
            if method != "*" {
                method.parse::<Method>().map_err(|e| {
                    anyhow::anyhow!("invalid --allowed-methods value {method:?}: {e}")
                })?;
            }
        }
        for header in &self.allow_headers {
            if header != "*" {
                header.parse::<HeaderName>().map_err(|e| {
                    anyhow::anyhow!("invalid --allowed-headers value {header:?}: {e}")
                })?;
            }
        }
        Ok(())

View on GitHub (pinned to c794754062)

Solutions

1. Correct the origin to a clean ASCII URL: https://example.com (no trailing slash issues, no spaces, scheme+host only)
2. Quote CLI arguments properly and pass each origin as its own value if the option is multi-value
3. Use punycode (xn--) for IDN hostnames
4. Use "*" only when wildcard CORS is actually intended

Example fix

# before
--allowed-origins 'https://example.com ' --allowed-origins https://api.example.com,https://web.example.com

# after
--allowed-origins https://example.com --allowed-origins https://api.example.com --allowed-origins https://web.example.com

// Mirror of the server-side check, run before config submission
for o in &allowed_origins {
    if o != "*" {
        o.parse::<http::HeaderValue>().map_err(|e| format!("invalid origin {o:?}: {e}"))?;
    }
}

fn valid_origin(o: &str) -> bool {
    o == "*" || o.parse::<http::HeaderValue>().is_ok()
}

When it happens

Trigger: Passing --allowed-origins with an invalid header value: origins containing whitespace, quotes, backslashes, or raw non-ASCII bytes; shell-quoting mistakes that leave stray characters in the value.

Common situations: Copy-pasted origins with trailing spaces or smart quotes; unquoted CLI args where the shell splits/mangles the URL; origins with unicode hostnames not in punycode; multiple origins passed as one comma-separated string where the config expects separate values.

Related errors

• invalid --allowed-methods value {method:?}: {e}
• invalid --allowed-headers value {header:?}: {e}
• {kind} parser `{name}` is not registered{}
• gpt_oss uses native Harmony output parsing; generic {kind} p
• failed to read chat template file

AI-assisted analysis of vllm-project/vllm@c794754062 (2026-08-14). Data as JSON: /api/errors/3913117c7ab467a4. Report an issue: GitHub.