{"id":"7872b48b12442cad","repo":"labstack/echo","slug":"s-is-missing-scheme-or-host-s","errorCode":null,"errorMessage":"%s is missing scheme or host: %s","messagePattern":"(.+?) is missing scheme or host: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/util.go","lineNumber":124,"sourceCode":"\t}\n}\n\nfunc validateOrigins(origins []string, what string) error {\n\tfor _, o := range origins {\n\t\tif err := validateOrigin(o, what); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateOrigin(origin string, what string) error {\n\tu, err := url.Parse(origin)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"can not parse %s: %w\", what, err)\n\t}\n\tif u.Scheme == \"\" || u.Host == \"\" {\n\t\treturn fmt.Errorf(\"%s is missing scheme or host: %s\", what, origin)\n\t}\n\tif u.Path != \"\" || u.RawQuery != \"\" || u.Fragment != \"\" {\n\t\treturn fmt.Errorf(\"%s can not have path, query, and fragments: %s\", what, origin)\n\t}\n\treturn nil\n}\n","sourceCodeStart":106,"sourceCodeEnd":131,"githubUrl":"https://github.com/labstack/echo/blob/05489dc1730161df26b72d1ae2a3ba6fb8178fc7/middleware/util.go#L106-L131","documentation":"Returned by validateOrigin() (util.go:124) when an origin parses successfully but is missing either Scheme or Host. Echo requires origins to be fully qualified 'scheme://host' values so they can be matched exactly. The '%s' is the context label, the trailing '%s' is the offending origin.","triggerScenarios":"Configuring CORS AllowOrigins or CSRF TrustedOrigins with entries like 'localhost:8080' (no scheme), 'example.com' (no scheme), or '/path' (no scheme/host). url.Parse accepts these but u.Scheme/u.Host end up empty.","commonSituations":"Developers writing 'localhost:3000' instead of 'http://localhost:3000'; configs using bare hostnames; mixing up origin format with Host header format.","solutions":["Prefix every origin with a scheme: 'http://localhost:3000' or 'https://example.com'.","For development, include both http and https variants explicitly.","Validate origins programmatically before passing to the middleware."],"exampleFix":"// before\ncfg := middleware.CORSConfig{AllowOrigins: []string{\"localhost:3000\", \"example.com\"}}\n// after\ncfg := middleware.CORSConfig{AllowOrigins: []string{\"http://localhost:3000\", \"https://example.com\"}}","handlingStrategy":"validation","validationCode":"func requireSchemeHost(origins []string) error {\n    for _, o := range origins {\n        u, err := url.Parse(o)\n        if err != nil { return err }\n        if u.Scheme == \"\" || u.Host == \"\" {\n            return fmt.Errorf(\"origin %q missing scheme or host\", o)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write origins as scheme://host[:port].","Validate scheme+host presence programmatically before middleware construction.","Document the required origin format for ops teams managing config."],"tags":["config","cors","csrf","url","startup"],"analyzedSha":"05489dc1730161df26b72d1ae2a3ba6fb8178fc7","analyzedAt":"2026-08-04T21:32:47.783Z","schemaVersion":2}