{"id":"d6ccdd198160cd7f","repo":"labstack/echo","slug":"as-allowed-origin-and-allowcredentials-true-is-i","errorCode":null,"errorMessage":"* as allowed origin and AllowCredentials=true is insecure and not allowed. Use custom UnsafeAllowOriginFunc","messagePattern":"\\* as allowed origin and AllowCredentials=true is insecure and not allowed\\. Use custom UnsafeAllowOriginFunc","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/cors.go","lineNumber":180,"sourceCode":"\tallowMethods := strings.Join(config.AllowMethods, \",\")\n\tallowHeaders := strings.Join(config.AllowHeaders, \",\")\n\texposeHeaders := strings.Join(config.ExposeHeaders, \",\")\n\n\tmaxAge := \"0\"\n\tif config.MaxAge > 0 {\n\t\tmaxAge = strconv.Itoa(config.MaxAge)\n\t}\n\n\tallowOriginFunc := config.UnsafeAllowOriginFunc\n\tif config.UnsafeAllowOriginFunc == nil {\n\t\tif len(config.AllowOrigins) == 0 {\n\t\t\treturn nil, errors.New(\"at least one AllowOrigins is required or UnsafeAllowOriginFunc must be provided\")\n\t\t}\n\t\tallowOriginFunc = config.defaultAllowOriginFunc\n\t\tfor _, origin := range config.AllowOrigins {\n\t\t\tif origin == \"*\" {\n\t\t\t\tif config.AllowCredentials {\n\t\t\t\t\treturn nil, fmt.Errorf(\"* as allowed origin and AllowCredentials=true is insecure and not allowed. Use custom UnsafeAllowOriginFunc\")\n\t\t\t\t}\n\t\t\t\tallowOriginFunc = config.starAllowOriginFunc\n\t\t\t\tbreak\n\t\t\t}\n\t\t\tif err := validateOrigin(origin, \"allow origin\"); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\t\tconfig.AllowOrigins = append([]string(nil), config.AllowOrigins...)\n\t}\n\n\treturn func(next echo.HandlerFunc) echo.HandlerFunc {\n\t\treturn func(c *echo.Context) error {\n\t\t\tif config.Skipper(c) {\n\t\t\t\treturn next(c)\n\t\t\t}\n\n\t\t\treq := c.Request()","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/labstack/echo/blob/05489dc1730161df26b72d1ae2a3ba6fb8178fc7/middleware/cors.go#L162-L198","documentation":"Returned by CORSConfig.ToMiddleware when AllowOrigins contains the wildcard \"*\" and AllowCredentials is true. Browsers themselves reject Access-Control-Allow-Origin: * combined with credentials, so this configuration can never work and Echo blocks it at wiring time as a deliberate safety guard. Use a custom UnsafeAllowOriginFunc to reflect the request Origin when you need credentialed CORS.","triggerScenarios":"CORSConfig{AllowOrigins: []string{\"*\"}, AllowCredentials: true}, or CORS(\"*\") combined with a config that sets AllowCredentials=true.","commonSituations":"Developer wants 'allow everyone with cookies' and reaches for the wildcard; copy-pasting a permissive CORS config into an authenticated API; or enabling AllowCredentials globally while debugging and forgetting to narrow origins.","solutions":["If you do not need cookies/credentials, remove AllowCredentials (leave it false) and keep the wildcard.","If you need credentials, list explicit origins instead of the wildcard.","If the allowed set is dynamic, provide UnsafeAllowOriginFunc that validates the request Origin and returns it reflected; this bypasses the wildcard check.","Never echo the Origin unchecked — validate against an allowlist to avoid CORS reflection attacks."],"exampleFix":"// before\nm := middleware.CORSWithConfig(middleware.CORSConfig{\n    AllowOrigins:     []string{\"*\"},\n    AllowCredentials: true,\n})\n// after\nm := middleware.CORSWithConfig(middleware.CORSConfig{\n    AllowOrigins:     []string{\"https://app.example.com\", \"https://admin.example.com\"},\n    AllowCredentials: true,\n})","handlingStrategy":"validation","validationCode":"func corsMiddleware(allowAll bool, creds bool, allowed []string) (echo.MiddlewareFunc, error) {\n    hasWildcard := false\n    for _, o := range allowed {\n        if o == \"*\" { hasWildcard = true }\n    }\n    if hasWildcard && creds {\n        return nil, errors.New(\"refusing wildcard origin with AllowCredentials; use explicit origins or UnsafeAllowOriginFunc\")\n    }\n    return middleware.CORSConfig{AllowOrigins: allowed, AllowCredentials: creds}.ToMiddleware()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never combine AllowOrigins=[\"*\"] with AllowCredentials=true; browsers reject it anyway.","If you need credentials, list explicit origins or implement UnsafeAllowOriginFunc with a strict allowlist.","Treat the UnsafeAllowOriginFunc name seriously — validate the Origin, never echo it blindly."],"tags":["middleware","cors","security","config","panic","credentials"],"analyzedSha":"05489dc1730161df26b72d1ae2a3ba6fb8178fc7","analyzedAt":"2026-08-04T21:32:47.783Z","schemaVersion":2}