A configuration field is supposed to identify a warehouse endpoint. Checking that its text starts with the expected host can accept a different host with the same prefix. Supplying a trusted base to new URL() is also insufficient when the supplied value is already an absolute URL.
For a Shopify 3PL configuration review, compare the parsed origin against the exact configured origin. The URL constructor resolves relative references but does not force an absolute input to stay under its base. This local example accepts absolute HTTPS URLs for one illustrative origin, without embedded credentials or a fragment.
Parse first, then apply the declared rule
'use strict'; const assert = require('node:assert/strict'); const allowedOrigin = 'https://warehouse.example.test'; function checkedEndpoint(text) { if (typeof text !== 'string' || text.length === 0 || text.trim() !== text) { throw new Error('Exact nonempty URL text required'); } const url = new URL(text); if (url.protocol !== 'https:' || url.origin !== allowedOrigin || url.username !== '' || url.password !== '' || url.href.includes('#')) { throw new Error('Endpoint outside configured URL policy'); } return url.href; } assert.equal(checkedEndpoint('https://warehouse.example.test/v1/items'), 'https://warehouse.example.test/v1/items'); assert.equal(checkedEndpoint('https://WAREHOUSE.example.test:443/v1/items'), 'https://warehouse.example.test/v1/items'); assert.equal(checkedEndpoint('https://warehouse.example.test/v1/items?sku=A'), 'https://warehouse.example.test/v1/items?sku=A'); for (const value of [ 'https://warehouse.example.test.other.test/v1/items', 'https://other.test/warehouse.example.test', 'https://warehouse.example.test@other.test/v1/items', 'https://user:secret@warehouse.example.test/v1/items', 'http://warehouse.example.test/v1/items', 'https://warehouse.example.test:444/v1/items', 'https://warehouse.example.test/v1/items#section', 'https://warehouse.example.test/v1/items#', '//warehouse.example.test/v1/items', '/v1/items', ' https://warehouse.example.test/v1/items', '', null ]) assert.throws(() => checkedEndpoint(value)); assert.equal(new URL('https://other.test/', allowedOrigin).origin, 'https://other.test'); console.log('Warehouse endpoint origin checks passed'); Save as endpoint-origin.cjs and run node endpoint-origin.cjs with Node.js 24. The assertions cover a host-prefix lookalike, a host placed in a path, user-info ambiguity, credentials, protocol and port differences, fragments, relative inputs and canonical handling of the default HTTPS port. All addresses and credential text are illustrative; no network request is made.
For HTTPS, URL.origin combines the protocol and host, with a nondefault port when present. Comparing that parsed value answers a narrower question than whether the entire endpoint is suitable for use.
Keep the rest of the connection contract explicit
A drop shipping adapter and a shopify fulfillment adapter may need different paths, methods and response schemas even on the same origin. This helper does not restrict routes or query parameters, resolve DNS, inspect redirects or establish endpoint ownership. Those require separate controls appropriate to the actual connection.
For China fulfillment, validate the configuration before attaching any real authentication material or customer data. A China 3PL handover still needs confirmed endpoint documentation, permitted operations and a separate test plan. An accepted URL is not evidence of a working production integration.
If “International Fulfillment for Folligen” names a hypothetical integration brief, its approved origin must come from the actual contract rather than the project name. I work with YX Fulfillment; its Shopify handover guide supplies related operational context. These executed checks demonstrate URL-policy behavior, not a live warehouse connection.
Warehouse workstations and equipment.
