Hi everyone, I apologize for the lack of update as I am unsure of the solution that I found.
What I did was - Add and configure CYPRESS_BASE_URL and set it to https://[frontend url] to get rid of some localhost calls in main.js - edit server.ts and add localhost to allowedHosts line 256 The second one seems more like a hack. I will have a look at your latest proposals for a fix. Best, Vincnt Le mar. 1 sept. 2026 à 11:16, Gary Hsu <[email protected]> a écrit : > Hi Vicent, > > I might have encoutered a similar issue that the localhost is not allowed. > At that time, I did find the solution to solve my problem and hopefully it > is applied to yours. > > *add http://localhost:4000/ <http://localhost:4000/> to the whitelist* > We may have multiple frontends listening to the backend. For example, one > public URL for the production site and one localhost for the development > site. We need to add the extra frontend to the list > cd /dspace/config sudo nano local.cfg > > add localhost in the local.cfg > ##################### # REST API SETTINGS # ##################### # > Allowed Cross-Origin-Resource-Sharing (CORS) origins (in > "Access-Control-Allow-Origin" header). # Only these origins (client URLs) > can successfully authenticate with your REST API. # Defaults to > ${dspace.ui.url} if unspecified (as the UI must have access to the REST > API). # Multiple allowed origin URLs may be comma separated. Wildcard value > (*) is NOT SUPPORTED. # (Requires reboot of servlet container, e.g. Tomcat, > to reload) # When an external authentication system is involved like > Shibboleth some browsers (i.e. Safari) include # in the request the Origin > header with the url of the IdP. In such case you need to allow also the IdP > to # avoid trouble for such browsers (i.e. rest.cors.allowed-origins = > ${dspace.ui.url}, https://samltest.id ) rest.cors.allowed-origins = > ${dspace.ui.url}, http://localhost:4000 > > restart tomcat > sudo systemctl restart tomcat10.service > > On Monday, July 20, 2026 at 4:15:49 PM UTC+2 Vincent B. wrote: > >> Hi everyone, >> >> I have been scratching my head about two frontend issues for hours. >> - ERR_INVALID_ADDRESS >> - Some localhost remaining in main.js >> >> This is my first installation of dSpace. Here are some infromations about >> the server >> - Windows server 2022 >> - nvm 24.15.0 >> - using pm2 and environment variables and node.exe for debug >> - IIS (10.0.xxxx)) reverse proxy with HTTPS >> >> Here is my dspace-ui.json >> { >> "apps": [ >> { >> "name": "dspace-ui", >> "cwd": "E:\\dspace-ui-deploy", >> "script": "dist\\server\\main.js", >> "instances": "max", >> "exec_mode": "cluster", >> "env": { >> "NODE_ENV": "production", >> "DSPACE_UI_SSL" : "false", >> "DSPACE_UI_HOST" : "127.0.0.1", >> "DSPACE_UI_PORT": "4000", >> "DSPACE_UI_SSL" : "false", >> "DSPACE_UI_NAMESPACE" : "/", >> "DSPACE_UI_SSL" : "false", >> "DSPACE_UI_BASEURL" : "https://[our frontend url]", >> "DSPACE_REST_SSL" : "true", >> "DSPACE_REST_HOST" : "[our backend url]", >> "DSPACE_REST_PORT" : "443", >> "DSPACE_REST_NAMESPACE" : "/server", >> } >> } >> ] >> } >> >> Those are replicated in Windows environment variables. >> >> After build and copying the built code to dspace-ui-deploy-dist I have >> two errors. >> >> First is related to having the port in the forwarded IP. >> ValidationError: An invalid 'request.ip' (192.168.24.13:54170) was >> detected. Consider passing a custom 'keyGenerator' function to the rate >> limiter. See >> https://express-rate-limit.github.io/ERR_ERL_INVALID_IP_ADDRESS/ for >> more information. >> at Object.ip (E:\dspace-ui-deploy\dist\server\main.js:1:3829713) >> at Object.wrappedValidations.<computed> [as ip] >> (E:\dspace-ui-deploy\dist\server\main.js:1:3837557) >> at E:\dspace-ui-deploy\dist\server\main.js:1:3839154 >> at Generator.next (<anonymous>) >> at asyncGeneratorStep >> (E:\dspace-ui-deploy\dist\server\main.js:1:3806369) >> at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3806609) >> at E:\dspace-ui-deploy\dist\server\main.js:1:3806728 >> at new ZoneAwarePromise >> (E:\dspace-ui-deploy\dist\server\main.js:1:3716681) >> at E:\dspace-ui-deploy\dist\server\main.js:1:3806545 >> at Object.keyGenerator >> (E:\dspace-ui-deploy\dist\server\main.js:1:3839558) { >> code: 'ERR_ERL_INVALID_IP_ADDRESS', >> help: 'https://express-rate-limit.github.io/ERR_ERL_INVALID_IP_ADDRESS/ >> ' >> } >> >> The issue is I have no idea where to set up this custom KeyGenerator to >> strip the IP from the port. Or should I fix it at reverse proxy level? >> >> Second issue is more troublesome. >> >> ERROR: URL with hostname "localhost" is not allowed.Please provide a list >> of allowed hosts in the "allowedHosts" option in the "CommonEngine" >> constructor. >> Error in server-side rendering (SSR) >> Error details : Error: URL with hostname "localhost" is not allowed. >> at validateUrl (E:\dspace-ui-deploy\dist\server\main.js:1:8227592) >> at E:\dspace-ui-deploy\dist\server\main.js:1:8227653 >> at Generator.next (<anonymous>) >> at asyncGeneratorStep >> (E:\dspace-ui-deploy\dist\server\main.js:1:3993125) >> at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3993350) >> at E:\dspace-ui-deploy\dist\server\main.js:1:3993469 >> at new ZoneAwarePromise >> (E:\dspace-ui-deploy\dist\server\main.js:1:3716681) >> at E:\dspace-ui-deploy\dist\server\main.js:1:3993286 >> at CommonEngine.render >> (E:\dspace-ui-deploy\dist\server\main.js:1:8229294) >> at serverSideRender >> (E:\dspace-ui-deploy\dist\server\main.js:1:8242424) >> Falling back to serving direct client-side rendering (CSR). >> GET /home 200 12.333 ms - 1115 >> Error: URL with hostname "localhost" is not allowed. >> at validateUrl (E:\dspace-ui-deploy\dist\server\main.js:1:8227592) >> at E:\dspace-ui-deploy\dist\server\main.js:1:8227653 >> at Generator.next (<anonymous>) >> at asyncGeneratorStep >> (E:\dspace-ui-deploy\dist\server\main.js:1:3993125) >> at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3993350) >> at E:\dspace-ui-deploy\dist\server\main.js:1:3993469 >> at new ZoneAwarePromise >> (E:\dspace-ui-deploy\dist\server\main.js:1:3716681) >> at E:\dspace-ui-deploy\dist\server\main.js:1:3993286 >> at CommonEngine.render >> (E:\dspace-ui-deploy\dist\server\main.js:1:8229294) >> at serverSideRender >> (E:\dspace-ui-deploy\dist\server\main.js:1:8242424) >> ERROR: URL with hostname "localhost" is not allowed.Please provide a list >> of allowed hosts in the "allowedHosts" option in the "CommonEngine" >> constructor. >> Error in server-side rendering (SSR) >> Error details : Error: URL with hostname "localhost" is not allowed. >> at validateUrl (E:\dspace-ui-deploy\dist\server\main.js:1:8227592) >> at E:\dspace-ui-deploy\dist\server\main.js:1:8227653 >> at Generator.next (<anonymous>) >> at asyncGeneratorStep >> (E:\dspace-ui-deploy\dist\server\main.js:1:3993125) >> at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3993350) >> at E:\dspace-ui-deploy\dist\server\main.js:1:3993469 >> at new ZoneAwarePromise >> (E:\dspace-ui-deploy\dist\server\main.js:1:3716681) >> at E:\dspace-ui-deploy\dist\server\main.js:1:3993286 >> at CommonEngine.render >> (E:\dspace-ui-deploy\dist\server\main.js:1:8229294) >> at serverSideRender >> (E:\dspace-ui-deploy\dist\server\main.js:1:8242424) >> Falling back to serving direct client-side rendering (CSR). >> >> >> I checked all my configuration variables and they are consistent with the >> dspce-ui.json. >> I still get some calls to localhost from main.js >> >> Like here, >> ... >> class sU { >> constructor() { >> this.production = !1, >> this.debug = !1, >> this.ui = { >> ssl: !1, >> host: "localhost", >> port: 4e3, >> nameSpace: "/", >> baseUrl: "http://localhost:4000";, >> rateLimiter: { >> windowMs: 6e4, >> limit: 500, >> ipv6Subnet: 56 >> }, >> useProxies: !0 >> }, >> ... >> >> >> The generated config.json seems correct >> >> "ui": { >> "ssl": false, >> "host": "localhost", >> "port": 4000, >> "nameSpace": "/", >> "baseUrl": "https://[our frontend url] " >> } >> } >> >> Does anyone have an idea of why I get those localhost in the main.js and >> what could be the root of the problem? >> >> Thanks a lot. >> >> Best, >> >> Vincent >> >> >> -- > All messages to this mailing list should adhere to the Code of Conduct: > https://lyrasis.org/code-of-conduct/ > --- > You received this message because you are subscribed to a topic in the > Google Groups "DSpace Technical Support" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/dspace-tech/5pXe65VY0IU/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > [email protected]. > To view this discussion visit > https://groups.google.com/d/msgid/dspace-tech/f2cd4e9a-9b11-4355-9890-75a70f8aa484n%40googlegroups.com > <https://groups.google.com/d/msgid/dspace-tech/f2cd4e9a-9b11-4355-9890-75a70f8aa484n%40googlegroups.com?utm_medium=email&utm_source=footer> > . > -- All messages to this mailing list should adhere to the Code of Conduct: https://lyrasis.org/code-of-conduct/ --- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/dspace-tech/CAC96Rp%2Bz4A7DExQ%3D%3DHc0AdUuOgBaV_BnwUNySPGwU9nJTCPa5Q%40mail.gmail.com.
