{"record":{"id":"c1c901e57040134e","repo":"gofiber/fiber","slug":"w-invalid-length-d-d","errorCode":null,"errorMessage":"%w: invalid length: %d != %d","messagePattern":"%w: invalid length: (.+?) != (.+?)","errorType":"validation","errorClass":"ErrInvalidIdempotencyKey","httpStatus":null,"severity":"warning","filePath":"middleware/idempotency/config.go","lineNumber":69,"sourceCode":"\t// DisableValueRedaction turns off masking idempotency keys in logs and errors when set to true.\n\t//\n\t// Optional. Default: false\n\tDisableValueRedaction bool\n}\n\n// ConfigDefault is the default config\nvar ConfigDefault = Config{\n\tNext: func(c fiber.Ctx) bool {\n\t\t// Skip middleware if the request was done using a safe HTTP method\n\t\treturn fiber.IsMethodSafe(c.Method())\n\t},\n\n\tLifetime: 30 * time.Minute,\n\n\tKeyHeader: \"X-Idempotency-Key\",\n\tKeyHeaderValidate: func(k string) error {\n\t\tif l, wl := len(k), 36; l != wl { // UUID length is 36 chars\n\t\t\treturn fmt.Errorf(\"%w: invalid length: %d != %d\", ErrInvalidIdempotencyKey, l, wl)\n\t\t}\n\n\t\treturn nil\n\t},\n\n\tKeepResponseHeaders: nil,\n\n\tLock: nil, // Set in configDefault so we don't allocate data here.\n\n\tStorage:               nil, // Set in configDefault so we don't allocate data here.\n\tDisableValueRedaction: false,\n}\n\n// Helper function to set default values\nfunc configDefault(config ...Config) Config {\n\t// Return default config if nothing provided\n\tif len(config) < 1 {\n\t\tcfg := ConfigDefault","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/gofiber/fiber/blob/a105acad6c1e4576a77f01e02973f67e962bb58d/middleware/idempotency/config.go#L51-L87","documentation":"Returned by the default KeyHeaderValidate in idempotency.ConfigDefault when the X-Idempotency-Key header is not exactly 36 characters (UUID length). It wraps ErrInvalidIdempotencyKey with the observed and expected lengths so callers can distinguish length errors from other key problems. The request is rejected before any storage or lock work.","triggerScenarios":"A client sends a non-safe HTTP method (POST/PUT/PATCH/DELETE) with an X-Idempotency-Key header whose length is not 36 characters — e.g. a truncated UUID, a UUID with braces, a non-UUID opaque token, or accidental whitespace.","commonSituations":"Clients sending a ULID/UUID-without-dashes/nanoID instead of a canonical UUID, frontends trimming/normalizing the header, proxies appending characters, or a custom KeyHeaderValidate that the developer forgot to override when moving to a non-UUID key format.","solutions":["Send a canonical 36-char UUID (uuid.NewString()) in X-Idempotency-Key.","If you use a different key format, override Config.KeyHeaderValidate with a validator that accepts it.","Strip whitespace from the header before validation if clients/proxies add it.","Return a 400 to clients with a clear message so they correct the key format."],"exampleFix":"// before\nKeyHeaderValidate: nil // uses default 36-char UUID check\n// after — accept any non-empty opaque key\nKeyHeaderValidate: func(k string) error {\n    if k == \"\" { return errors.New(\"empty idempotency key\") }\n    return nil\n}","handlingStrategy":"validation","validationCode":"if len(c.Get(\"X-Idempotency-Key\")) != 36 {\n    return c.Status(fiber.StatusBadRequest).SendString(\"idempotency key must be a 36-char UUID\")\n}","typeGuard":"func isUUIDLength(k string) bool { return len(k) == 36 }","tryCatchPattern":null,"preventionTips":["Generate keys with uuid.NewString() on the client.","Override KeyHeaderValidate if you use a non-UUID key format.","Return 400 with guidance so clients self-correct."],"tags":["idempotency","validation","uuid","http-headers"],"backgroundTag":null,"analyzedSha":"a105acad6c1e4576a77f01e02973f67e962bb58d","analyzedAt":"2026-08-11T17:33:26.942Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}