{"id":"5deceee6621d56e4","repo":"labstack/echo","slug":"at-least-one-alloworigins-is-required-or-unsafeall","errorCode":null,"errorMessage":"at least one AllowOrigins is required or UnsafeAllowOriginFunc must be provided","messagePattern":"at least one AllowOrigins is required or UnsafeAllowOriginFunc must be provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/cors.go","lineNumber":174,"sourceCode":"\thasCustomAllowMethods := true\n\tif len(config.AllowMethods) == 0 {\n\t\thasCustomAllowMethods = false\n\t\tconfig.AllowMethods = []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete}\n\t}\n\n\tallowMethods := strings.Join(config.AllowMethods, \",\")\n\tallowHeaders := strings.Join(config.AllowHeaders, \",\")\n\texposeHeaders := strings.Join(config.ExposeHeaders, \",\")\n\n\tmaxAge := \"0\"\n\tif config.MaxAge > 0 {\n\t\tmaxAge = strconv.Itoa(config.MaxAge)\n\t}\n\n\tallowOriginFunc := config.UnsafeAllowOriginFunc\n\tif config.UnsafeAllowOriginFunc == nil {\n\t\tif len(config.AllowOrigins) == 0 {\n\t\t\treturn nil, errors.New(\"at least one AllowOrigins is required or UnsafeAllowOriginFunc must be provided\")\n\t\t}\n\t\tallowOriginFunc = config.defaultAllowOriginFunc\n\t\tfor _, origin := range config.AllowOrigins {\n\t\t\tif origin == \"*\" {\n\t\t\t\tif config.AllowCredentials {\n\t\t\t\t\treturn nil, fmt.Errorf(\"* as allowed origin and AllowCredentials=true is insecure and not allowed. Use custom UnsafeAllowOriginFunc\")\n\t\t\t\t}\n\t\t\t\tallowOriginFunc = config.starAllowOriginFunc\n\t\t\t\tbreak\n\t\t\t}\n\t\t\tif err := validateOrigin(origin, \"allow origin\"); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\t\tconfig.AllowOrigins = append([]string(nil), config.AllowOrigins...)\n\t}\n\n\treturn func(next echo.HandlerFunc) echo.HandlerFunc {","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/labstack/echo/blob/05489dc1730161df26b72d1ae2a3ba6fb8178fc7/middleware/cors.go#L156-L192","documentation":"Returned by CORSConfig.ToMiddleware when both AllowOrigins is empty and UnsafeAllowOriginFunc is nil. CORS requires at least one allowed origin (or a custom validator) to populate the Access-Control-Allow-Origin header; with neither, the middleware cannot decide whom to trust. Surfaced as a panic via CORSWithConfig / CORS().","triggerScenarios":"Calling CORSWithConfig(CORSConfig{}) with no AllowOrigins and no UnsafeAllowOriginFunc, or calling CORS() with zero variadic arguments (allowOrigins...string expands to nil).","commonSituations":"Developer switches from CORS(\"https://app.example.com\") to CORSWithConfig to set AllowMethods/AllowHeaders and forgets to carry AllowOrigins over; or an empty env var feeds the origin list producing an empty slice.","solutions":["Pass at least one origin: CORS(\"https://app.example.com\") or set AllowOrigins in the config.","If origins must be computed dynamically, set UnsafeAllowOriginFunc instead (it overrides AllowOrigins).","When loading origins from config/env, fail fast at boot if the resulting slice is empty rather than passing it to the middleware.","Use config.ToMiddleware() to receive the error instead of a panic during wiring."],"exampleFix":"// before\nm := middleware.CORSWithConfig(middleware.CORSConfig{\n    AllowMethods: []string{http.MethodGet, http.MethodPost},\n})\n// after\nm := middleware.CORSWithConfig(middleware.CORSConfig{\n    AllowOrigins: []string{\"https://app.example.com\"},\n    AllowMethods: []string{http.MethodGet, http.MethodPost},\n})","handlingStrategy":"validation","validationCode":"func corsMiddleware(origins []string) (echo.MiddlewareFunc, error) {\n    cfg := middleware.CORSConfig{AllowOrigins: origins}\n    if len(cfg.AllowOrigins) == 0 && cfg.UnsafeAllowOriginFunc == nil {\n        return nil, errors.New(\"CORS requires at least one AllowOrigins entry or UnsafeAllowOriginFunc\")\n    }\n    return cfg.ToMiddleware()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass at least one origin to CORS(...) or set AllowOrigins in CORSWithConfig.","When origins come from env/config, fail fast at boot if the slice is empty.","Use cfg.ToMiddleware() in wiring code to receive the error instead of a panic."],"tags":["middleware","cors","config","panic","security","startup"],"analyzedSha":"05489dc1730161df26b72d1ae2a3ba6fb8178fc7","analyzedAt":"2026-08-04T21:32:47.783Z","schemaVersion":2}