{"id":"6dd646d19b4ae8b3","repo":"gofiber/fiber","slug":"hostauthorization-allowedhosts-or-allowedhostsfun","errorCode":null,"errorMessage":"hostauthorization: AllowedHosts or AllowedHostsFunc is required","messagePattern":"hostauthorization: AllowedHosts or AllowedHostsFunc is required","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/hostauthorization/config.go","lineNumber":57,"sourceCode":"\t// Entries are normalized at startup: port stripped, trailing dot removed,\n\t// lowercased, IDN labels converted to Punycode, RFC 1035 length limits enforced\n\t// (≤253 total / ≤63 per-label).\n\t//\n\t// Required if AllowedHostsFunc is nil.\n\tAllowedHosts []string\n}\n\n// ConfigDefault is the default config.\nvar ConfigDefault = Config{}\n\nfunc configDefault(config ...Config) Config {\n\tcfg := ConfigDefault\n\tif len(config) > 0 {\n\t\tcfg = config[0]\n\t}\n\n\tif len(cfg.AllowedHosts) == 0 && cfg.AllowedHostsFunc == nil {\n\t\tpanic(\"hostauthorization: AllowedHosts or AllowedHostsFunc is required\")\n\t}\n\n\tif cfg.ErrorHandler == nil {\n\t\tcfg.ErrorHandler = func(c fiber.Ctx, _ error) error {\n\t\t\treturn c.SendStatus(fiber.StatusForbidden)\n\t\t}\n\t}\n\n\treturn cfg\n}\n","sourceCodeStart":39,"sourceCodeEnd":68,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/hostauthorization/config.go#L39-L68","documentation":"The hostauthorization middleware exists to allowlist Host header values; with neither AllowedHosts nor AllowedHostsFunc set it would have nothing to check and every request would either be rejected or allowed (depending on defaults). configDefault (config.go:56-58) panics when AllowedHosts is empty AND AllowedHostsFunc is nil so that the middleware is never deployed in a no-op state.","triggerScenarios":"Calling hostauthorization.New(hostauthorization.Config{}) with no AllowedHosts slice and no AllowedHostsFunc. Also when AllowedHosts is loaded from an env var that resolves to an empty slice.","commonSituations":"Adding hostauthorization for security hardening but forgetting to populate AllowedHosts in non-production environments, or a config struct left at zero values during a refactor.","solutions":["Provide an explicit allowlist: hostauthorization.Config{AllowedHosts: []string{\"example.com\", \"*.example.com\"}}.","For dynamic host sets, implement AllowedHostsFunc to return the permitted list per request.","Load AllowedHosts from config and fail app startup if the resulting slice is empty."],"exampleFix":"// before\nhostauthorization.New(hostauthorization.Config{})\n\n// after\nhostauthorization.New(hostauthorization.Config{\n    AllowedHosts: []string{\"example.com\", \"www.example.com\"},\n})","handlingStrategy":"validation","validationCode":"func validateHostAuthConfig(cfg hostauthorization.Config) error {\n    if len(cfg.AllowedHosts) == 0 && cfg.AllowedHostsFunc == nil {\n        return errors.New(\"AllowedHosts or AllowedHostsFunc is required\")\n    }\n    return nil\n}\n\nif err := validateHostAuthConfig(cfg); err != nil { log.Fatal(err) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Load AllowedHosts from config and fail startup if empty.","Default to a strict allowlist in every environment."],"tags":["hostauthorization","security","config","allowed-hosts","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}