{"record":{"id":"ef6460f47275ee07","repo":"seanmonstar/warp","slug":"invalid-origin","errorCode":null,"errorMessage":"invalid Origin","messagePattern":"invalid Origin","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/filters/cors.rs","lineNumber":620,"sourceCode":"    }\n\n    impl Seconds for ::std::time::Duration {\n        fn seconds(self) -> u64 {\n            self.as_secs()\n        }\n    }\n\n    pub trait IntoOrigin {\n        fn into_origin(self) -> Origin;\n    }\n\n    impl<'a> IntoOrigin for &'a str {\n        fn into_origin(self) -> Origin {\n            let mut parts = self.splitn(2, \"://\");\n            let scheme = parts.next().expect(\"missing scheme\");\n            let rest = parts.next().expect(\"missing scheme\");\n\n            Origin::try_from_parts(scheme, rest, None).expect(\"invalid Origin\")\n        }\n    }\n}\n","sourceCodeStart":602,"sourceCodeEnd":624,"githubUrl":"https://github.com/seanmonstar/warp/blob/ff34d7213ed55ec342304aa7ff6ac4b351da9e66/src/filters/cors.rs#L602-L624","documentation":"After splitting an origin string on \"://\", warp calls `Origin::try_from_parts(scheme, rest, None)` and `.expect(\"invalid Origin\")` (src/filters/cors.rs:620). This panics when the scheme exists but the authority part is not a valid origin — e.g. it contains a path, invalid characters, or an unusable port. It is an unrecoverable programmer/config error by design: warp treats a malformed allow-origin entry as a startup-time bug.","triggerScenarios":"`warp::cors().allow_origin(..)` with strings like \"https://example.com/path\" (origin must not include a path), \"https://\" (empty authority), origins with spaces, wildcard entries expressed as \"https://*\" where `try_from_parts` rejects them, or IPv6 hosts written unbracketed.","commonSituations":"Users pasting full URLs with paths from a browser address bar into CORS config; hand-edited config adding trailing slashes; attempting to use \"null\" or wildcard syntax in the wrong form; building origins dynamically with string concatenation and leaving stray segments.","solutions":["Use bare `scheme://host[:port]` with no path, query, or trailing slash: \"https://example.com\"","For any-origin access use `warp::cors().allow_any_origin()` instead of a wildcard string","Validate the origin by parsing it (e.g. check `url.origin()` equivalent: scheme + host + optional port only) before registering","Switch to `allow_origin_fn` for pattern matching (subdomains) rather than encoding wildcards in the string"],"exampleFix":"// before\nlet cors = warp::cors().allow_origin(\"https://example.com/api\");\n// after\nlet cors = warp::cors().allow_origin(\"https://example.com\");","handlingStrategy":"validation","validationCode":"fn validate_origin(s: &str) -> Result<(), String> {\n    let (scheme, rest) = s.split_once(\"://\").ok_or(\"missing scheme\")?;\n    if rest.is_empty() || rest.contains('/') || rest.contains('?') || rest.contains('#') {\n        return Err(format!(\"'{}' is not a bare origin (scheme://host[:port] only)\", s));\n    }\n    Ok(())\n}","typeGuard":"fn is_bare_origin(s: &str) -> bool {\n    s.split_once(\"://\").map_or(false, |(_, rest)| !rest.is_empty() && !rest.contains(['/','?','#']))\n}","tryCatchPattern":null,"preventionTips":["Never include paths, queries, or trailing slashes in origin entries","Use allow_any_origin() instead of \"*\"-style strings when any origin is acceptable","Reject wildcard-looking entries in config validation and suggest allow_origin_fn","Log parsed origins at startup so misconfiguration is visible immediately"],"tags":["cors","panic","origin-parsing","configuration"],"backgroundTag":"invalid-url-format","analyzedSha":"ff34d7213ed55ec342304aa7ff6ac4b351da9e66","analyzedAt":"2026-09-09T16:57:46.316Z","contentChangedAt":"2026-09-09T16:57:46.316Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}