{"id":"e1be7128f4d55902","repo":"gofiber/fiber","slug":"cors-invalid-origin-format-after-normalization","errorCode":null,"errorMessage":"[CORS] Invalid origin format after normalization:${maskedOrigin}","messagePattern":"\\[CORS\\] Invalid origin format after normalization:(.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/cors/cors.go","lineNumber":77,"sourceCode":"\n\t// Validate and normalize static AllowOrigins\n\tallowAllOrigins := len(cfg.AllowOrigins) == 0 && cfg.AllowOriginsFunc == nil\n\tfor _, origin := range cfg.AllowOrigins {\n\t\tif origin == \"*\" {\n\t\t\tallowAllOrigins = true\n\t\t\tbreak\n\t\t}\n\n\t\ttrimmedOrigin := utils.TrimSpace(origin)\n\t\tif before, after, found := strings.Cut(trimmedOrigin, \"://*.\"); found {\n\t\t\twithoutWildcard := before + \"://\" + after\n\t\t\tisValid, normalizedOrigin := normalizeOrigin(withoutWildcard)\n\t\t\tif !isValid {\n\t\t\t\tpanic(\"[CORS] Invalid origin format in configuration: \" + maskValue(trimmedOrigin))\n\t\t\t}\n\t\t\tscheme, host, ok := strings.Cut(normalizedOrigin, \"://\")\n\t\t\tif !ok {\n\t\t\t\tpanic(\"[CORS] Invalid origin format after normalization:\" + maskValue(trimmedOrigin))\n\t\t\t}\n\t\t\tsd := subdomain{prefix: scheme + \"://\", suffix: host}\n\t\t\tallowSubOrigins = append(allowSubOrigins, sd)\n\t\t} else {\n\t\t\tisValid, normalizedOrigin := normalizeOrigin(trimmedOrigin)\n\t\t\tif !isValid {\n\t\t\t\tpanic(\"[CORS] Invalid origin format in configuration: \" + maskValue(trimmedOrigin))\n\t\t\t}\n\t\t\tallowOrigins[normalizedOrigin] = struct{}{}\n\t\t}\n\t}\n\n\t// Validate CORS credentials configuration\n\tif cfg.AllowCredentials && allowAllOrigins {\n\t\tpanic(\"[CORS] Configuration error: When 'AllowCredentials' is set to true, 'AllowOrigins' cannot contain a wildcard origin '*'. Please specify allowed origins explicitly or adjust 'AllowCredentials' setting.\")\n\t}\n\n\t// Warn if allowAllOrigins is set to true and AllowOriginsFunc is defined","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/cors/cors.go#L59-L95","documentation":"A defensive panic in the CORS wildcard-subdomain branch (cors.go:75-78). After normalizeOrigin succeeds it splits the normalized origin on \"://\" to obtain scheme and host for the subdomain matcher; if that Cut fails it indicates normalizeOrigin returned a value without a scheme separator, which should be unreachable. Surfacing it as a panic prevents a corrupted entry from being stored as a subdomain matcher that matches nothing or everything.","triggerScenarios":"Effectively unreachable under normal use; would only fire if normalizeOrigin's contract changed to return a host-only string, or if a future edit to the normalization logic produced an origin without \"://\". In practice you will not hit this unless you are editing the cors package internals.","commonSituations":"Encountered only when forking or contributing to the cors middleware and changing normalizeOrigin. Not a configuration error a user can trigger with a normal AllowOrigins value.","solutions":["If you are a user (not editing the cors package), the real culprit is almost certainly error 262 or 264 — double-check the exact AllowOrigins entry; this line should not be the top frame.","If you are editing cors/utils.go normalizeOrigin, ensure it always returns 'scheme://host' for valid origins.","Report the offending origin string and the cors package version as a bug; include the stack trace."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// This line is effectively unreachable for end users; wrap middleware\n// construction in recover during config bootstrap to surface a clear message.\nfunc mustNewCORS(cfg cors.Config) cors.Handler {\n    defer func() {\n        if r := recover(); r != nil {\n            log.Fatalf(\"cors.New panicked (likely error 262/264): %v\", r)\n        }\n    }()\n    return cors.New(cfg)\n}","preventionTips":["If you see this specific line as the top frame, treat it as a bug in your fork of cors and check normalizeOrigin.","Keep cors package at a released version rather than an edited checkout."],"tags":["cors","security","origin","internal","panic","defensive"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}