{"id":"e762b6c032609be6","repo":"gofiber/fiber","slug":"helmet-hstsmaxage-must-be-greater-than-or-equal-t","errorCode":null,"errorMessage":"helmet: HSTSMaxAge must be greater than or equal to 0","messagePattern":"helmet: HSTSMaxAge must be greater than or equal to 0","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/helmet/config.go","lineNumber":110,"sourceCode":"\tCrossOriginResourcePolicy: \"same-origin\",\n\tOriginAgentCluster:        \"?1\",\n\tXDNSPrefetchControl:       \"off\",\n\tXDownloadOptions:          \"noopen\",\n\tXPermittedCrossDomain:     \"none\",\n}\n\n// Helper function to set default values\nfunc configDefault(config ...Config) Config {\n\t// Return default config if nothing provided\n\tif len(config) < 1 {\n\t\treturn ConfigDefault\n\t}\n\n\t// Override default config\n\tcfg := config[0]\n\n\tif cfg.HSTSMaxAge < 0 {\n\t\tpanic(\"helmet: HSTSMaxAge must be greater than or equal to 0\")\n\t}\n\n\tif cfg.HSTSPreloadEnabled && cfg.HSTSExcludeSubdomains {\n\t\tpanic(\"helmet: HSTSPreloadEnabled requires HSTSExcludeSubdomains to be false\")\n\t}\n\n\t// Set default values\n\tif cfg.XSSProtection == \"\" {\n\t\tcfg.XSSProtection = ConfigDefault.XSSProtection\n\t}\n\n\tif cfg.ContentTypeNosniff == \"\" {\n\t\tcfg.ContentTypeNosniff = ConfigDefault.ContentTypeNosniff\n\t}\n\n\tif cfg.XFrameOptions == \"\" {\n\t\tcfg.XFrameOptions = ConfigDefault.XFrameOptions\n\t}","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/helmet/config.go#L92-L128","documentation":"HSTSMaxAge (seconds) is emitted in the Strict-Transport-Security header; a negative value is nonsensical and would be rejected by browsers. configDefault (helmet/config.go:109-111) panics when HSTSMaxAge < 0 so the header is never emitted with an invalid duration. Zero is allowed and disables the max-age directive.","triggerScenarios":"Passing helmet.Config{HSTSMaxAge: -1} (or any negative int). Often a calculation error such as subtracting a desired duration from a base value, or an uninitialized int32 field set to a sentinel.","commonSituations":"Computing HSTSMaxAge from a time.Duration and forgetting to convert, e.g. HSTSMaxAge: int(-time.Since(someTime)), or copying a config that used -1 as 'unset' in another library.","solutions":["Set HSTSMaxAge to a positive number of seconds (e.g. 63072000 for two years) or 0 to disable.","Compute it explicitly: HSTSMaxAge: int((2 * 365 * 24 * time.Hour).Seconds()).","Grep your config for any arithmetic that could yield a negative value."],"exampleFix":"// before\nhelmet.New(helmet.Config{HSTSMaxAge: -1})\n\n// after\nhelmet.New(helmet.Config{HSTSMaxAge: 63072000}) // 2 years","handlingStrategy":"validation","validationCode":"func validateHSTSMaxAge(age int) error {\n    if age < 0 { return errors.New(\"HSTSMaxAge must be >= 0\") }\n    return nil\n}\n\nif err := validateHSTSMaxAge(cfg.HSTSMaxAge); err != nil { log.Fatal(err) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use 0 to disable max-age rather than a negative sentinel.","Compute HSTSMaxAge from time.Duration with .Seconds() and assert positivity."],"tags":["helmet","hsts","security","config","headers","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}