Mod HTTP Requests

Mods can make HTTP requests, but only to addresses that have been explicitly approved for that specific mod. On a player’s own game this is handled by a prompt at the main menu. A dedicated server has no main menu and never prompts, so mods on your server cannot make any HTTP requests until you approve their origins by hand.

On startup, a dedicated server will log warnings if mods are requesting access to origins that are not approved or denied, like this:

LogModHttp: Warning: 3 HTTP origin(s) requested by mods have not been allowed or denied, requests to them will fail.
LogModHttp: Warning: To allow or deny, add these lines to "C:/Program Files (x86)/Steam/steamapps/common/Conan Exiles Dedicated Server/ConanSandbox/Saved/Config/WindowsServer/ModHttp.ini" and restart the server.
LogModHttp: Warning: Change AllowedOrigin to DeniedOrigin to deny the mod access to an origin.
LogModHttp: Warning:   [HttpTest]    ; mod "HTTP Demonstrator Mod"
LogModHttp: Warning:   AllowedOrigin="https://discord.com:443"    ; reason: "post join/leave announcements"
LogModHttp: Warning:   AllowedOrigin="https://httpbin.org"    ; reason: "echo back http requests as a test"

Approvals live in ModHttp.ini, in your server’s Saved/Config/ directory:

Windows: SteamLibrary/steamapps/common/Conan Exiles Dedicated Server/ConanSandbox/Saved/Config/WindowsServer/ModHttp.ini
Linux: ConanSandbox/Saved/Config/LinuxServer/ModHttp.ini

Create the file if it is not there. It takes one section per mod, named after the mod’s folder, listing the addresses that mod is allowed to contact:

[MyMod]
AllowedOrigin="https://api.example.com"
AllowedOrigin="https://scores.example.com:8443"

Restart the server after editing.

What you are approving

Each entry is an origin, which is the scheme://host:port part of a URL, and nothing more. It is matched exactly, so approving https://api.example.com does not approve https://cdn.example.com, https://example.com, http://api.example.com, or a different port on the same host. Each of those would need its own line. The path is irrelevant: one entry covers every URL on that host.

Approval is per mod. A section only grants access to the mod whose folder name it matches, so two mods that both need the same address each need their own entry.

Quote the value. An unquoted // is read as the start of a comment, so AllowedOrigin=https://api.example.com is ignored.

Treat a request for an address you do not recognise the same way would treat any other unknown outbound traffic from your server. Check the server logs for warning messages, or the mod’s documentation or Steam workshop page, for the mod author’s reasoning for needing access. A mod with no entry still loads and runs, it just cannot reach the internet.

See the HTTP requests modding documentation for the modder’s side of this - how origins are declared and what players are asked.

Last updated on August 24, 2026