{"id":"d6db4be22766518a","repo":"gofiber/fiber","slug":"hostauthorization-host-q-exceeds-rfc-1035-maximu","errorCode":null,"errorMessage":"hostauthorization: host %q exceeds RFC 1035 maximum of %d characters (%d chars)","messagePattern":"hostauthorization: host %q exceeds RFC 1035 maximum of (.+?) characters \\((.+?) chars\\)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/hostauthorization/hostauthorization.go","lineNumber":69,"sourceCode":"\t\t\tcontinue\n\t\t}\n\n\t\tvalidateHostLength(h)\n\n\t\tif isWildcard {\n\t\t\t// Stored with leading dot so the hot-path HasSuffix check stays alloc-free.\n\t\t\tparsed.wildcardSuffixes = append(parsed.wildcardSuffixes, \".\"+h)\n\t\t} else {\n\t\t\tparsed.exact[h] = struct{}{}\n\t\t}\n\t}\n\n\treturn parsed\n}\n\nfunc validateHostLength(host string) {\n\tif len(host) > maxDomainLength {\n\t\tpanic(fmt.Sprintf(\"hostauthorization: host %q exceeds RFC 1035 maximum of %d characters (%d chars)\",\n\t\t\thost, maxDomainLength, len(host)))\n\t}\n\t// IPv6 hosts contain colons and aren't dotted labels.\n\tif strings.IndexByte(host, ':') >= 0 {\n\t\treturn\n\t}\n\tfor label := range strings.SplitSeq(host, \".\") {\n\t\tif len(label) > maxLabelLength {\n\t\t\tpanic(fmt.Sprintf(\"hostauthorization: host %q has label %q exceeding RFC 1035 limit of %d characters (%d chars)\",\n\t\t\t\thost, label, maxLabelLength, len(label)))\n\t\t}\n\t}\n}\n\n// normalizeHost strips port, trailing dot, and IPv6 brackets, lowercases,\n// and converts IDN labels to Punycode (matching what browsers send).\nfunc normalizeHost(host string) string {\n\t// Fast path for plain hostnames — avoids net.SplitHostPort's error allocation.","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/hostauthorization/hostauthorization.go#L51-L87","documentation":"RFC 1035 caps a domain name at 253 characters total. validateHostLength (hostauthorization.go:67-71) panics when the normalized host exceeds maxDomainLength (253) so an over-long entry — which would be rejected by resolvers anyway — is caught at startup rather than silently never matching.","triggerScenarios":"An AllowedHosts entry whose normalized form (port stripped, trailing dot removed, lowercased, Punycode-encoded) exceeds 253 characters. IPv6 hosts (containing ':') skip the label check but still pass the total-length check.","commonSituations":"Dynamic/generated hostnames (e.g. long tenant-qualified names in a multi-tenant SaaS) that accumulate segments, or IDN domains whose Punycode encoding ('xn--...') is far longer than the readable form.","solutions":["Shorten the hostname; split deep hierarchies into shorter labels or use a wildcard parent.","If the long name is generated, cap its length at the generator and reject over-length tenants at provisioning time.","Confirm you did not accidentally concatenate multiple hostnames into one entry."],"exampleFix":"// before\nAllowedHosts: []string{\"a.really.deeply.nested.tenant.subdomain.that.keeps.going.example.com\"} // >253 chars\n\n// after\nAllowedHosts: []string{\"*.example.com\"} // match the deep subdomains via wildcard","handlingStrategy":"validation","validationCode":"const maxDomain = 253\n\nfunc validateHostTotalLength(hosts []string) error {\n    for _, h := range hosts {\n        if strings.HasPrefix(h, \"*.\") { h = h[2:] }\n        if strings.Contains(h, \":\") { continue } // IPv6\n        if len(h) > maxDomain {\n            return fmt.Errorf(\"host %q is %d chars, exceeds RFC 1035 max %d\", h, len(h), maxDomain)\n        }\n    }\n    return nil\n}\n\nif err := validateHostTotalLength(cfg.AllowedHosts); err != nil { log.Fatal(err) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Cap generated hostnames at provisioning time.","Remember IDN Punycode encoding can be much longer than the unicode form."],"tags":["hostauthorization","security","rfc-1035","dns","config","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}