{"record":{"id":"d5ebe4bb0d2248c9","repo":"seanmonstar/warp","slug":"origin-is-always-a-valid-headervalue","errorCode":null,"errorMessage":"Origin is always a valid HeaderValue","messagePattern":"Origin is always a valid HeaderValue","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/filters/cors.rs","lineNumber":226,"sourceCode":"\n    /// Add multiple origins to the existing list of allowed `Origin`s.\n    ///\n    /// # Panics\n    ///\n    /// Panics if the provided argument is not a valid `Origin`.\n    pub fn allow_origins<I>(mut self, origins: I) -> Self\n    where\n        I: IntoIterator,\n        I::Item: IntoOrigin,\n    {\n        let iter = origins\n            .into_iter()\n            .map(IntoOrigin::into_origin)\n            .map(|origin| {\n                origin\n                    .to_string()\n                    .parse()\n                    .expect(\"Origin is always a valid HeaderValue\")\n            });\n\n        self.origins.get_or_insert_with(HashSet::new).extend(iter);\n\n        self\n    }\n\n    /// Sets the `Access-Control-Max-Age` header.\n    ///\n    /// # Example\n    ///\n    ///\n    /// ```\n    /// use std::time::Duration;\n    /// use warp::Filter;\n    ///\n    /// let cors = warp::cors()\n    ///     .max_age(30) // 30u32 seconds","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/seanmonstar/warp/blob/ff34d7213ed55ec342304aa7ff6ac4b351da9e66/src/filters/cors.rs#L208-L244","documentation":"Cors::allow_origins converts each origin to a string and parses it as a HeaderValue, expecting success always ('Origin is always a valid HeaderValue'). This expect panics only if an origin string somehow isn't a valid header value — practically unreachable via valid Origin inputs, but reachable through the &str IntoOrigin path's own panics for malformed origins.","triggerScenarios":"cors().allow_origins(&[\"bad origin\"]) with strings failing Origin parsing (see allow_origin's 'missing scheme'/'invalid Origin' panics); direct panic at this line is nearly impossible with well-formed origins.","commonSituations":"Passing full URLs with paths ('https://x.com/path') or malformed origins to allow_origins; config entries that aren't bare origins.","solutions":["Pass bare origins like \"https://example.com\" without paths, queries, or trailing slashes","Validate each origin string parses as an Origin before building the CORS layer","Prefer allow_origins with typed Origin values where available"],"exampleFix":"// before\ncors().allow_origins(&[\"https://example.com/api\"])\n// after\ncors().allow_origins(&[\"https://example.com\"])","handlingStrategy":"validation","validationCode":"fn is_bare_origin(s: &str) -> bool {\n    let mut parts = s.splitn(2, \"://\");\n    parts.next().map_or(false, |sch| !sch.is_empty()) && parts.next().map_or(false, |rest| !rest.is_empty() && !rest.contains('/'))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pass bare scheme://host origins without paths or queries","Validate origin strings at config-load time","Prefer typed Origin inputs over raw strings"],"tags":["cors","origin","panic"],"backgroundTag":"invalid-url-format","analyzedSha":"ff34d7213ed55ec342304aa7ff6ac4b351da9e66","analyzedAt":"2026-09-09T16:57:46.316Z","contentChangedAt":"2026-09-09T16:57:46.316Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}