{"id":"f0d7eb7c328ef914","repo":"labstack/echo","slug":"s-can-not-have-path-query-and-fragments-s","errorCode":null,"errorMessage":"%s can not have path, query, and fragments: %s","messagePattern":"(.+?) can not have path, query, and fragments: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/util.go","lineNumber":127,"sourceCode":"func validateOrigins(origins []string, what string) error {\n\tfor _, o := range origins {\n\t\tif err := validateOrigin(o, what); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateOrigin(origin string, what string) error {\n\tu, err := url.Parse(origin)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"can not parse %s: %w\", what, err)\n\t}\n\tif u.Scheme == \"\" || u.Host == \"\" {\n\t\treturn fmt.Errorf(\"%s is missing scheme or host: %s\", what, origin)\n\t}\n\tif u.Path != \"\" || u.RawQuery != \"\" || u.Fragment != \"\" {\n\t\treturn fmt.Errorf(\"%s can not have path, query, and fragments: %s\", what, origin)\n\t}\n\treturn nil\n}\n","sourceCodeStart":109,"sourceCodeEnd":131,"githubUrl":"https://github.com/labstack/echo/blob/05489dc1730161df26b72d1ae2a3ba6fb8178fc7/middleware/util.go#L109-L131","documentation":"Returned by validateOrigin() (util.go:127) when an origin parses to a valid scheme+host but ALSO carries a path, query, or fragment. Security origins must be bare 'scheme://host[:port]'; any path/query/fragment is rejected because origin matching is scheme+host only.","triggerScenarios":"Configuring an origin like 'https://example.com/api', 'https://example.com?x=1', or 'https://example.com#section' in CORS AllowOrigins or CSRF TrustedOrigins. The presence of u.Path, u.RawQuery, or u.Fragment trips this check.","commonSituations":"Copying a full URL instead of an origin from documentation; appending API paths to the origin string; misunderstanding that CORS origins never include paths.","solutions":["Strip path, query, and fragment from every origin: keep only 'scheme://host[:port]'.","Use url.Parse and reconstruct with only Scheme+Host (and Host:Port) if needed.","Remember CORS origins are scheme+host+port only — never paths."],"exampleFix":"// before\ncfg := middleware.CORSConfig{AllowOrigins: []string{\"https://app.example.com/dashboard\"}}\n// after\ncfg := middleware.CORSConfig{AllowOrigins: []string{\"https://app.example.com\"}}","handlingStrategy":"validation","validationCode":"func requireBareOrigins(origins []string) error {\n    for _, o := range origins {\n        u, err := url.Parse(o)\n        if err != nil { return err }\n        if u.Path != \"\" || u.RawQuery != \"\" || u.Fragment != \"\" {\n            return fmt.Errorf(\"origin %q must not contain path/query/fragment\", o)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip everything after the host:port when forming origins.","Remember CORS origins are scheme+host+port only.","Use url.Parse to normalize and reconstruct bare origins from config."],"tags":["config","cors","csrf","url","startup"],"analyzedSha":"05489dc1730161df26b72d1ae2a3ba6fb8178fc7","analyzedAt":"2026-08-04T21:32:47.783Z","schemaVersion":2}