Hi Vicent, I might have encoutered a similar issue that the localhost is not allowed. At that time, I did find the solution to solve my problem and hopefully it is applied to yours.
*add http://localhost:4000/ to the whitelist* We may have multiple frontends listening to the backend. For example, one public URL for the production site and one localhost for the development site. We need to add the extra frontend to the list cd /dspace/config sudo nano local.cfg add localhost in the local.cfg ##################### # REST API SETTINGS # ##################### # Allowed Cross-Origin-Resource-Sharing (CORS) origins (in "Access-Control-Allow-Origin" header). # Only these origins (client URLs) can successfully authenticate with your REST API. # Defaults to ${dspace.ui.url} if unspecified (as the UI must have access to the REST API). # Multiple allowed origin URLs may be comma separated. Wildcard value (*) is NOT SUPPORTED. # (Requires reboot of servlet container, e.g. Tomcat, to reload) # When an external authentication system is involved like Shibboleth some browsers (i.e. Safari) include # in the request the Origin header with the url of the IdP. In such case you need to allow also the IdP to # avoid trouble for such browsers (i.e. rest.cors.allowed-origins = ${dspace.ui.url}, https://samltest.id ) rest.cors.allowed-origins = ${dspace.ui.url}, http://localhost:4000 restart tomcat sudo systemctl restart tomcat10.service On Monday, July 20, 2026 at 4:15:49 PM UTC+2 Vincent B. wrote: > Hi everyone, > > I have been scratching my head about two frontend issues for hours. > - ERR_INVALID_ADDRESS > - Some localhost remaining in main.js > > This is my first installation of dSpace. Here are some infromations about > the server > - Windows server 2022 > - nvm 24.15.0 > - using pm2 and environment variables and node.exe for debug > - IIS (10.0.xxxx)) reverse proxy with HTTPS > > Here is my dspace-ui.json > { > "apps": [ > { > "name": "dspace-ui", > "cwd": "E:\\dspace-ui-deploy", > "script": "dist\\server\\main.js", > "instances": "max", > "exec_mode": "cluster", > "env": { > "NODE_ENV": "production", > "DSPACE_UI_SSL" : "false", > "DSPACE_UI_HOST" : "127.0.0.1", > "DSPACE_UI_PORT": "4000", > "DSPACE_UI_SSL" : "false", > "DSPACE_UI_NAMESPACE" : "/", > "DSPACE_UI_SSL" : "false", > "DSPACE_UI_BASEURL" : "https://[our frontend url]", > "DSPACE_REST_SSL" : "true", > "DSPACE_REST_HOST" : "[our backend url]", > "DSPACE_REST_PORT" : "443", > "DSPACE_REST_NAMESPACE" : "/server", > } > } > ] > } > > Those are replicated in Windows environment variables. > > After build and copying the built code to dspace-ui-deploy-dist I have two > errors. > > First is related to having the port in the forwarded IP. > ValidationError: An invalid 'request.ip' (192.168.24.13:54170) was > detected. Consider passing a custom 'keyGenerator' function to the rate > limiter. See > https://express-rate-limit.github.io/ERR_ERL_INVALID_IP_ADDRESS/ for more > information. > at Object.ip (E:\dspace-ui-deploy\dist\server\main.js:1:3829713) > at Object.wrappedValidations.<computed> [as ip] > (E:\dspace-ui-deploy\dist\server\main.js:1:3837557) > at E:\dspace-ui-deploy\dist\server\main.js:1:3839154 > at Generator.next (<anonymous>) > at asyncGeneratorStep > (E:\dspace-ui-deploy\dist\server\main.js:1:3806369) > at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3806609) > at E:\dspace-ui-deploy\dist\server\main.js:1:3806728 > at new ZoneAwarePromise > (E:\dspace-ui-deploy\dist\server\main.js:1:3716681) > at E:\dspace-ui-deploy\dist\server\main.js:1:3806545 > at Object.keyGenerator > (E:\dspace-ui-deploy\dist\server\main.js:1:3839558) { > code: 'ERR_ERL_INVALID_IP_ADDRESS', > help: 'https://express-rate-limit.github.io/ERR_ERL_INVALID_IP_ADDRESS/' > } > > The issue is I have no idea where to set up this custom KeyGenerator to > strip the IP from the port. Or should I fix it at reverse proxy level? > > Second issue is more troublesome. > > ERROR: URL with hostname "localhost" is not allowed.Please provide a list > of allowed hosts in the "allowedHosts" option in the "CommonEngine" > constructor. > Error in server-side rendering (SSR) > Error details : Error: URL with hostname "localhost" is not allowed. > at validateUrl (E:\dspace-ui-deploy\dist\server\main.js:1:8227592) > at E:\dspace-ui-deploy\dist\server\main.js:1:8227653 > at Generator.next (<anonymous>) > at asyncGeneratorStep > (E:\dspace-ui-deploy\dist\server\main.js:1:3993125) > at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3993350) > at E:\dspace-ui-deploy\dist\server\main.js:1:3993469 > at new ZoneAwarePromise > (E:\dspace-ui-deploy\dist\server\main.js:1:3716681) > at E:\dspace-ui-deploy\dist\server\main.js:1:3993286 > at CommonEngine.render > (E:\dspace-ui-deploy\dist\server\main.js:1:8229294) > at serverSideRender (E:\dspace-ui-deploy\dist\server\main.js:1:8242424) > Falling back to serving direct client-side rendering (CSR). > GET /home 200 12.333 ms - 1115 > Error: URL with hostname "localhost" is not allowed. > at validateUrl (E:\dspace-ui-deploy\dist\server\main.js:1:8227592) > at E:\dspace-ui-deploy\dist\server\main.js:1:8227653 > at Generator.next (<anonymous>) > at asyncGeneratorStep > (E:\dspace-ui-deploy\dist\server\main.js:1:3993125) > at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3993350) > at E:\dspace-ui-deploy\dist\server\main.js:1:3993469 > at new ZoneAwarePromise > (E:\dspace-ui-deploy\dist\server\main.js:1:3716681) > at E:\dspace-ui-deploy\dist\server\main.js:1:3993286 > at CommonEngine.render > (E:\dspace-ui-deploy\dist\server\main.js:1:8229294) > at serverSideRender (E:\dspace-ui-deploy\dist\server\main.js:1:8242424) > ERROR: URL with hostname "localhost" is not allowed.Please provide a list > of allowed hosts in the "allowedHosts" option in the "CommonEngine" > constructor. > Error in server-side rendering (SSR) > Error details : Error: URL with hostname "localhost" is not allowed. > at validateUrl (E:\dspace-ui-deploy\dist\server\main.js:1:8227592) > at E:\dspace-ui-deploy\dist\server\main.js:1:8227653 > at Generator.next (<anonymous>) > at asyncGeneratorStep > (E:\dspace-ui-deploy\dist\server\main.js:1:3993125) > at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3993350) > at E:\dspace-ui-deploy\dist\server\main.js:1:3993469 > at new ZoneAwarePromise > (E:\dspace-ui-deploy\dist\server\main.js:1:3716681) > at E:\dspace-ui-deploy\dist\server\main.js:1:3993286 > at CommonEngine.render > (E:\dspace-ui-deploy\dist\server\main.js:1:8229294) > at serverSideRender (E:\dspace-ui-deploy\dist\server\main.js:1:8242424) > Falling back to serving direct client-side rendering (CSR). > > > I checked all my configuration variables and they are consistent with the > dspce-ui.json. > I still get some calls to localhost from main.js > > Like here, > ... > class sU { > constructor() { > this.production = !1, > this.debug = !1, > this.ui = { > ssl: !1, > host: "localhost", > port: 4e3, > nameSpace: "/", > baseUrl: "http://localhost:4000";, > rateLimiter: { > windowMs: 6e4, > limit: 500, > ipv6Subnet: 56 > }, > useProxies: !0 > }, > ... > > > The generated config.json seems correct > > "ui": { > "ssl": false, > "host": "localhost", > "port": 4000, > "nameSpace": "/", > "baseUrl": "https://[our frontend url] " > } > } > > Does anyone have an idea of why I get those localhost in the main.js and > what could be the root of the problem? > > Thanks a lot. > > Best, > > Vincent > > > -- All messages to this mailing list should adhere to the Code of Conduct: https://lyrasis.org/code-of-conduct/ --- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/dspace-tech/f2cd4e9a-9b11-4355-9890-75a70f8aa484n%40googlegroups.com.
