{"id":"e4fab0dfca6e3116","repo":"gofiber/fiber","slug":"cors-invalid-origin-format-in-configuration-m","errorCode":null,"errorMessage":"[CORS] Invalid origin format in configuration: ${maskedOrigin}","messagePattern":"\\[CORS\\] Invalid origin format in configuration: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/cors/cors.go","lineNumber":73,"sourceCode":"\t// allowOrigins is a set of strings that contains the allowed origins\n\t// defined in the 'AllowOrigins' configuration.\n\tallowOrigins := make(map[string]struct{}, len(cfg.AllowOrigins))\n\tallowSubOrigins := []subdomain{}\n\n\t// Validate and normalize static AllowOrigins\n\tallowAllOrigins := len(cfg.AllowOrigins) == 0 && cfg.AllowOriginsFunc == nil\n\tfor _, origin := range cfg.AllowOrigins {\n\t\tif origin == \"*\" {\n\t\t\tallowAllOrigins = true\n\t\t\tbreak\n\t\t}\n\n\t\ttrimmedOrigin := utils.TrimSpace(origin)\n\t\tif before, after, found := strings.Cut(trimmedOrigin, \"://*.\"); found {\n\t\t\twithoutWildcard := before + \"://\" + after\n\t\t\tisValid, normalizedOrigin := normalizeOrigin(withoutWildcard)\n\t\t\tif !isValid {\n\t\t\t\tpanic(\"[CORS] Invalid origin format in configuration: \" + maskValue(trimmedOrigin))\n\t\t\t}\n\t\t\tscheme, host, ok := strings.Cut(normalizedOrigin, \"://\")\n\t\t\tif !ok {\n\t\t\t\tpanic(\"[CORS] Invalid origin format after normalization:\" + maskValue(trimmedOrigin))\n\t\t\t}\n\t\t\tsd := subdomain{prefix: scheme + \"://\", suffix: host}\n\t\t\tallowSubOrigins = append(allowSubOrigins, sd)\n\t\t} else {\n\t\t\tisValid, normalizedOrigin := normalizeOrigin(trimmedOrigin)\n\t\t\tif !isValid {\n\t\t\t\tpanic(\"[CORS] Invalid origin format in configuration: \" + maskValue(trimmedOrigin))\n\t\t\t}\n\t\t\tallowOrigins[normalizedOrigin] = struct{}{}\n\t\t}\n\t}\n\n\t// Validate CORS credentials configuration\n\tif cfg.AllowCredentials && allowAllOrigins {","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/cors/cors.go#L55-L91","documentation":"During CORS config validation (cors.go:69-74), an AllowOrigins entry containing the wildcard subdomain marker \"://*.\" is stripped of the wildcard and passed to normalizeOrigin. If normalizeOrigin rejects it (invalid URL parse, empty host, embedded '*', userinfo, path, query, or fragment), the middleware panics at startup so a misconfigured CORS policy never silently allows the wrong origins.","triggerScenarios":"Setting AllowOrigins to a malformed wildcard subdomain such as \"https://*\" (no suffix), \"*://*.example.com\" (wildcard scheme), \"https://*.example.com/admin\" (path present), or an entry whose non-wildcard remainder cannot parse as scheme://host.","commonSituations":"Devs write \"https://*.example.com/path\" intending to scope CORS to a path, or use a bare \"https://*\" expecting it to match all subdomains of all domains. Env-var interpolation that produces an empty/placeholder origin also lands here.","solutions":["Use the bare wildcard-subdomain form with no path: AllowOrigins: []string{\"https://*.example.com\"}.","Verify the scheme is present and the host is non-empty after removing the leading '*.'.","If you need path-scoped CORS, enforce it in your handler — CORS origins are scheme+host only.","Log the resolved AllowOrigins value at startup in environments that pull it from env vars to catch empty/misconfigured entries before they panic."],"exampleFix":"// before\ncors.New(cors.Config{AllowOrigins: []string{\"https://*.example.com/api\"}})\n\n// after\ncors.New(cors.Config{AllowOrigins: []string{\"https://*.example.com\"}})","handlingStrategy":"validation","validationCode":"// Pre-validate wildcard subdomain origins before cors.New.\nimport \"net/url\"\n\nfunc validWildcardCORSOrigin(o string) bool {\n    before, after, found := strings.Cut(o, \"://*.\")\n    if !found { return false }\n    if before == \"\" || after == \"\" { return false }\n    u, err := url.Parse(before + \"://\" + after)\n    return err == nil && u.Host != \"\" && !strings.Contains(u.Host, \"*\") &&\n        (u.Path == \"\" || u.Path == \"/\") && u.RawQuery == \"\" && u.Fragment == \"\"\n}\n\nfor _, o := range cfg.AllowOrigins {\n    if strings.Contains(o, \"://*.\") && !validWildcardCORSOrigin(o) {\n        log.Fatalf(\"invalid CORS wildcard origin: %s\", o)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize wildcard origins as exactly \"scheme://*.host\" with no path.","Add a unit test that asserts every AllowOrigins entry is accepted by normalizeOrigin at startup."],"tags":["cors","security","config","origin","wildcard","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}