{"record":{"id":"b68ee671afbf718e","repo":"gofiber/fiber","slug":"hostauthorization-invalid-host-h-subdomain-w","errorCode":null,"errorMessage":"hostauthorization: invalid host ${h} — subdomain wildcards use the \"*.example.com\" form","messagePattern":"hostauthorization: invalid host (.+?) — subdomain wildcards use the \"\\*\\.example\\.com\" form","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/hostauthorization/hostauthorization.go","lineNumber":41,"sourceCode":"}\n\n// parseAllowedHosts splits AllowedHosts into exact and wildcard groups,\n// normalizing entries (port strip, lowercase, IDN→Punycode) and enforcing\n// RFC 1035 length limits. Panics on misconfiguration so it surfaces at startup.\nfunc parseAllowedHosts(hosts []string) parsedHosts {\n\tparsed := parsedHosts{\n\t\texact: make(map[string]struct{}, len(hosts)),\n\t}\n\n\tfor _, h := range hosts {\n\t\th = utils.TrimSpace(h)\n\t\tif h == \"\" {\n\t\t\tcontinue\n\t\t}\n\n\t\t// Reject the leading-dot form some other tools use; we want \"*.example.com\".\n\t\tif len(h) > 1 && h[0] == '.' {\n\t\t\tpanic(\"hostauthorization: invalid host \" + h + \" — subdomain wildcards use the \\\"*.example.com\\\" form\")\n\t\t}\n\n\t\tisWildcard := strings.HasPrefix(h, \"*.\")\n\t\tif isWildcard {\n\t\t\th = h[2:]\n\t\t}\n\n\t\th = normalizeHost(h)\n\t\tif h == \"\" {\n\t\t\tcontinue\n\t\t}\n\n\t\tvalidateHostLength(h)\n\n\t\tif isWildcard {\n\t\t\t// Stored with leading dot so the hot-path HasSuffix check stays alloc-free.\n\t\t\tparsed.wildcardSuffixes = append(parsed.wildcardSuffixes, \".\"+h)\n\t\t} else {","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/gofiber/fiber/blob/a105acad6c1e4576a77f01e02973f67e962bb58d/middleware/hostauthorization/hostauthorization.go#L23-L59","documentation":"When parsing AllowedHosts, hostauthorization rejects entries that begin with a dot (e.g. \".example.com\"). Some other tools use the leading-dot form for subdomain matching, but this middleware requires the explicit \"*.example.com\" wildcard form so wildcard intent is unambiguous and the hot-path suffix check stays simple. Note the message interpolates the host verbatim (it concatenates h), so the literal offending entry appears in the panic.","triggerScenarios":"AllowedHosts: []string{\".example.com\"} or any entry whose first character is '.' and length > 1. Often happens when migrating allowlists from nginx/CORS-style configs that use a leading dot.","commonSituations":"Copying a domain allowlist from a CORS or cookie-domain config (which frequently use .example.com); bulk-importing hostnames from a spreadsheet that prefixes subdomain entries with a dot; legacy config ported from another framework.","solutions":["Convert \".example.com\" to \"*.example.com\" to match all subdomains.","If you also need the apex matched, list both: \"example.com\" and \"*.example.com\" (the wildcard does NOT match the bare domain).","Strip leading dots programmatically only if you intend exact host matching, not wildcard matching."],"exampleFix":"// before\nhostauthorization.New(hostauthorization.Config{\n    AllowedHosts: []string{\".example.com\"},\n})\n\n// after\nhostauthorization.New(hostauthorization.Config{\n    AllowedHosts: []string{\"example.com\", \"*.example.com\"},\n})","handlingStrategy":"validation","validationCode":"func normalizeAllowedHosts(in []string) []string {\n    out := make([]string, 0, len(in))\n    for _, h := range in {\n        h = strings.TrimSpace(h)\n        if strings.HasPrefix(h, \".\") {\n            h = \"*\" + h // convert \".example.com\" -> \"*.example.com\"\n        }\n        if h != \"\" {\n            out = append(out, h)\n        }\n    }\n    return out\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the \"*.example.com\" wildcard form consistently; reject leading-dot entries in your config validator.","When importing allowlists from other tools, run a normalization pass.","List both apex and wildcard if you need both matched."],"tags":["hostauthorization","config","wildcard","dns","startup-panic"],"backgroundTag":null,"analyzedSha":"a105acad6c1e4576a77f01e02973f67e962bb58d","analyzedAt":"2026-08-11T17:33:26.942Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}