{"id":"a28f8d6f06c3e018","repo":"gofiber/fiber","slug":"hostauthorization-host-q-has-label-q-exceeding","errorCode":null,"errorMessage":"hostauthorization: host %q has label %q exceeding RFC 1035 limit of %d characters (%d chars)","messagePattern":"hostauthorization: host %q has label %q exceeding RFC 1035 limit of (.+?) characters \\((.+?) chars\\)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/hostauthorization/hostauthorization.go","lineNumber":78,"sourceCode":"\t\t\tparsed.exact[h] = struct{}{}\n\t\t}\n\t}\n\n\treturn parsed\n}\n\nfunc validateHostLength(host string) {\n\tif len(host) > maxDomainLength {\n\t\tpanic(fmt.Sprintf(\"hostauthorization: host %q exceeds RFC 1035 maximum of %d characters (%d chars)\",\n\t\t\thost, maxDomainLength, len(host)))\n\t}\n\t// IPv6 hosts contain colons and aren't dotted labels.\n\tif strings.IndexByte(host, ':') >= 0 {\n\t\treturn\n\t}\n\tfor label := range strings.SplitSeq(host, \".\") {\n\t\tif len(label) > maxLabelLength {\n\t\t\tpanic(fmt.Sprintf(\"hostauthorization: host %q has label %q exceeding RFC 1035 limit of %d characters (%d chars)\",\n\t\t\t\thost, label, maxLabelLength, len(label)))\n\t\t}\n\t}\n}\n\n// normalizeHost strips port, trailing dot, and IPv6 brackets, lowercases,\n// and converts IDN labels to Punycode (matching what browsers send).\nfunc normalizeHost(host string) string {\n\t// Fast path for plain hostnames — avoids net.SplitHostPort's error allocation.\n\tif host != \"\" && host[0] != '[' && strings.IndexByte(host, ':') < 0 {\n\t\thost = trimOneTrailingDot(host)\n\t\thost = utilsstrings.ToLower(host)\n\t\treturn toPunycode(host)\n\t}\n\n\tif h, _, err := net.SplitHostPort(host); err == nil {\n\t\thost = h\n\t} else {","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/hostauthorization/hostauthorization.go#L60-L96","documentation":"RFC 1035 caps each label (the text between dots) at 63 characters. validateHostLength (hostauthorization.go:76-80) iterates labels via SplitSeq and panics when any single label exceeds maxLabelLength (63). IPv6 hosts (which contain ':') skip the per-label check because their structure is not dotted labels.","triggerScenarios":"An AllowedHosts entry containing a single label longer than 63 characters, e.g. \"a-very-long-single-label-without-any-dots-that-exceeds-sixty-three-characters.example.com\".","commonSituations":"Generated/host-derived hostnames where one segment (a tenant id, hash, or slug) is unusually long, or IDN labels whose Punycode form ('xn--' + encoded) exceeds 63 bytes even though the unicode form looked short.","solutions":["Shorten the offending label to 63 characters or fewer; truncate or hash long identifiers.","For IDN domains, check the Punycode length, not the unicode length.","Validate generated hostnames against the 63-byte label limit before storing them as allowed hosts."],"exampleFix":"// before\nAllowedHosts: []string{\"thisLabelIsWayTooLongToBeValidUnderRFC1035RulesBecauseItExceedsSixtyThreeChars.example.com\"}\n\n// after\nAllowedHosts: []string{\"short.example.com\"} // each label <= 63 chars","handlingStrategy":"validation","validationCode":"const maxLabel = 63\n\nfunc validateHostLabelLengths(hosts []string) error {\n    for _, h := range hosts {\n        if strings.HasPrefix(h, \"*.\") { h = h[2:] }\n        if strings.Contains(h, \":\") { continue } // IPv6\n        for _, label := range strings.Split(h, \".\") {\n            if len(label) > maxLabel {\n                return fmt.Errorf(\"label %q in %q is %d chars, exceeds RFC 1035 max %d\",\n                    label, h, len(label), maxLabel)\n            }\n        }\n    }\n    return nil\n}\n\nif err := validateHostLabelLengths(cfg.AllowedHosts); err != nil { log.Fatal(err) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate generated tenant/host identifiers against the 63-byte label limit.","Check Punycode length for IDN labels, not the unicode length."],"tags":["hostauthorization","security","rfc-1035","dns","label-length","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}