{"record":{"id":"16d557f25de0c22e","repo":"kataras/iris","slug":"origin-not-allowed","errorCode":null,"errorMessage":"origin not allowed","messagePattern":"origin not allowed","errorType":"error_code","errorClass":null,"httpStatus":403,"severity":"warning","filePath":"middleware/cors/cors.go","lineNumber":21,"sourceCode":"import (\n\t\"errors\"\n\t\"net/http\"\n\t\"regexp\"\n\t\"strconv\"\n\t\"strings\"\n\t\"time\"\n\n\t\"github.com/kataras/iris/v12/context\"\n)\n\nfunc init() {\n\tcontext.SetHandlerName(\"iris/middleware/cors.*\", \"iris.cors\")\n}\n\nvar (\n\t// ErrOriginNotAllowed is given to the error handler\n\t// when the error is caused because an origin was not allowed to pass through.\n\tErrOriginNotAllowed = errors.New(\"origin not allowed\")\n\n\t// AllowAnyOrigin allows all origins to pass.\n\tAllowAnyOrigin = func(_ *context.Context, _ string) bool {\n\t\treturn true\n\t}\n\n\t// DefaultErrorHandler is the default error handler which\n\t// fires forbidden status (403) on disallowed origins.\n\tDefaultErrorHandler = func(ctx *context.Context, _ error) {\n\t\tctx.StopWithStatus(http.StatusForbidden)\n\t}\n\n\t// DefaultOriginExtractor is the default method which\n\t// an origin is extracted. It returns the value of the request's \"Origin\" header\n\t// and always true, means that it allows empty origin headers as well.\n\tDefaultOriginExtractor = func(ctx *context.Context) (string, bool) {\n\t\theader := ctx.GetHeader(originRequestHeader)\n\t\treturn header, true","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/middleware/cors/cors.go#L3-L39","documentation":"ErrOriginNotAllowed is returned by the CORS middleware's handler when the request's Origin header does not pass the configured origin-allow check. It is handed to the user-supplied error handler so the developer can decide the response; by default the middleware disallows cross-origin requests from unregistered origins.","triggerScenarios":"A browser sends a cross-origin request with Origin: https://evil.com (or any origin not in the allowed list) to a route wrapped with cors.New(); the AllowOriginFunc returns false and the error handler receives ErrOriginNotAllowed.","commonSituations":"Forgetting to add the frontend's production or localhost origin to the allowed origins; deploying to a new domain without updating CORS config; using the strict default check while AllowAnyOrigin was expected.","solutions":["Register the missing origin in the CORS options' AllowedOrigins or supply an AllowOriginFunc that accepts it.","Use cors.AllowAnyOrigin (only for public APIs / dev) if all origins should pass.","Make sure the exact origin including scheme and port matches, e.g. 'http://localhost:3000'.","Handle ErrOriginNotAllowed in the custom error handler to return a proper 403 response."],"exampleFix":"// before\nc := cors.New()\n\n// after\nc := cors.New(cors.Options{\n    AllowedOrigins: []string{\"https://myapp.com\", \"http://localhost:3000\"},\n})","handlingStrategy":"fallback","validationCode":"const allowed = ['https://myapp.com', 'http://localhost:3000'];\nif (!allowed.includes(window.location.origin)) {\n  throw new Error(`Origin ${window.location.origin} not in server CORS allowlist`);\n}","typeGuard":null,"tryCatchPattern":"// server-side handler\nh := cors.New().AllowOriginFunc(...)\napp.WrapRouter(func(w http.ResponseWriter, r *http.Request) {\n    // inside the cors error handler:\n    if errors.Is(err, cors.ErrOriginNotAllowed) {\n        ctx.StatusCode(http.StatusForbidden)\n        return\n    }\n})","preventionTips":["Keep an env-driven list of allowed origins and update it per deployment.","Match scheme + host + port exactly.","Never use AllowAnyOrigin with credentials."],"tags":["cors","http","security","iris"],"backgroundTag":"cors-origin-not-allowed","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}