{"id":"4a55156abcc8d664","repo":"gofiber/fiber","slug":"cors-configuration-error-when-allowcredentials","errorCode":null,"errorMessage":"[CORS] Configuration error: When 'AllowCredentials' is set to true, 'AllowOrigins' cannot contain a wildcard origin '*'. Please specify allowed origins explicitly or adjust 'AllowCredentials' setting.","messagePattern":"\\[CORS\\] Configuration error: When 'AllowCredentials' is set to true, 'AllowOrigins' cannot contain a wildcard origin '\\*'\\. Please specify allowed origins explicitly or adjust 'AllowCredentials' setting\\.","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/cors/cors.go","lineNumber":92,"sourceCode":"\t\t\t}\n\t\t\tscheme, host, ok := strings.Cut(normalizedOrigin, \"://\")\n\t\t\tif !ok {\n\t\t\t\tpanic(\"[CORS] Invalid origin format after normalization:\" + maskValue(trimmedOrigin))\n\t\t\t}\n\t\t\tsd := subdomain{prefix: scheme + \"://\", suffix: host}\n\t\t\tallowSubOrigins = append(allowSubOrigins, sd)\n\t\t} else {\n\t\t\tisValid, normalizedOrigin := normalizeOrigin(trimmedOrigin)\n\t\t\tif !isValid {\n\t\t\t\tpanic(\"[CORS] Invalid origin format in configuration: \" + maskValue(trimmedOrigin))\n\t\t\t}\n\t\t\tallowOrigins[normalizedOrigin] = struct{}{}\n\t\t}\n\t}\n\n\t// Validate CORS credentials configuration\n\tif cfg.AllowCredentials && allowAllOrigins {\n\t\tpanic(\"[CORS] Configuration error: When 'AllowCredentials' is set to true, 'AllowOrigins' cannot contain a wildcard origin '*'. Please specify allowed origins explicitly or adjust 'AllowCredentials' setting.\")\n\t}\n\n\t// Warn if allowAllOrigins is set to true and AllowOriginsFunc is defined\n\tif allowAllOrigins && cfg.AllowOriginsFunc != nil {\n\t\tlog.Warn(\"[CORS] 'AllowOrigins' is set to allow all origins, 'AllowOriginsFunc' will not be used.\")\n\t}\n\n\t// Convert int to string\n\tmaxAge := strconv.Itoa(cfg.MaxAge)\n\n\t// Return new handler\n\treturn func(c fiber.Ctx) error {\n\t\t// Don't execute middleware if Next returns true\n\t\tif cfg.Next != nil && cfg.Next(c) {\n\t\t\treturn c.Next()\n\t\t}\n\n\t\t// Get origin header preserving the original case for the response","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/cors/cors.go#L74-L110","documentation":"Per the Fetch spec, a server MUST NOT respond with Access-Control-Allow-Credentials combined with a wildcard Access-Control-Allow-Origin of '*', because that would let any origin send credentialed (cookie/auth) requests. CORS config validation (cors.go:91-93) sets allowAllOrigins when AllowOrigins contains '*' or both AllowOrigins and AllowOriginsFunc are empty, then panics if AllowCredentials is also true.","triggerScenarios":"Calling cors.New(Config{AllowCredentials: true, AllowOrigins: []string{\"*\"}}), or AllowCredentials: true with no AllowOrigins and no AllowOriginsFunc (which also resolves to allowAllOrigins).","commonSituations":"Copy-pasting a permissive CORS config and then flipping AllowCredentials on for cookie-based auth. Also: relying on the empty-default (allow all) while adding a Session middleware that needs credentials.","solutions":["Enumerate the specific origins that may send credentials: AllowOrigins: []string{\"https://app.example.com\", \"https://admin.example.com\"}.","If the allowed set is dynamic, implement AllowOriginsFunc instead of using '*'.","If credentials are not actually required, set AllowCredentials: false (the default) and keep '*'.","Never combine AllowOriginsFunc + AllowCredentials with a function that returns true for every request."],"exampleFix":"// before\ncors.New(cors.Config{AllowOrigins: []string{\"*\"}, AllowCredentials: true})\n\n// after\ncors.New(cors.Config{AllowOrigins: []string{\"https://app.example.com\"}, AllowCredentials: true})","handlingStrategy":"validation","validationCode":"func validateCORSConfig(cfg cors.Config) error {\n    allowAll := len(cfg.AllowOrigins) == 0 && cfg.AllowOriginsFunc == nil\n    for _, o := range cfg.AllowOrigins {\n        if o == \"*\" { allowAll = true }\n    }\n    if cfg.AllowCredentials && allowAll {\n        return errors.New(\"AllowCredentials cannot be combined with wildcard '*' or empty AllowOrigins\")\n    }\n    return nil\n}\n\nif err := validateCORSConfig(cfg); err != nil { log.Fatal(err) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat AllowCredentials + '*' as a security review trigger.","Prefer an explicit origin list or a strict AllowOriginsFunc whenever credentials are enabled."],"tags":["cors","security","credentials","wildcard","spec-compliance","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}