[CORS] Configuration error: When 'AllowCredentials' is set t

Error message

[CORS] Configuration error: When 'AllowCredentials' is set to true, 'AllowOrigins' cannot contain a wildcard origin '*'. Please specify allowed origins explicitly or adjust 'AllowCredentials' setting.

What it means

Per the Fetch spec, a server MUST NOT respond with Access-Control-Allow-Credentials combined with a wildcard Access-Control-Allow-Origin of '*', because that would let any origin send credentialed (cookie/auth) requests. CORS config validation (cors.go:91-93) sets allowAllOrigins when AllowOrigins contains '*' or both AllowOrigins and AllowOriginsFunc are empty, then panics if AllowCredentials is also true.

Source

Thrown at middleware/cors/cors.go:92

			}
			scheme, host, ok := strings.Cut(normalizedOrigin, "://")
			if !ok {
				panic("[CORS] Invalid origin format after normalization:" + maskValue(trimmedOrigin))
			}
			sd := subdomain{prefix: scheme + "://", suffix: host}
			allowSubOrigins = append(allowSubOrigins, sd)
		} else {
			isValid, normalizedOrigin := normalizeOrigin(trimmedOrigin)
			if !isValid {
				panic("[CORS] Invalid origin format in configuration: " + maskValue(trimmedOrigin))
			}
			allowOrigins[normalizedOrigin] = struct{}{}
		}
	}

	// Validate CORS credentials configuration
	if cfg.AllowCredentials && allowAllOrigins {
		panic("[CORS] Configuration error: When 'AllowCredentials' is set to true, 'AllowOrigins' cannot contain a wildcard origin '*'. Please specify allowed origins explicitly or adjust 'AllowCredentials' setting.")
	}

	// Warn if allowAllOrigins is set to true and AllowOriginsFunc is defined
	if allowAllOrigins && cfg.AllowOriginsFunc != nil {
		log.Warn("[CORS] 'AllowOrigins' is set to allow all origins, 'AllowOriginsFunc' will not be used.")
	}

	// Convert int to string
	maxAge := strconv.Itoa(cfg.MaxAge)

	// Return new handler
	return func(c fiber.Ctx) error {
		// Don't execute middleware if Next returns true
		if cfg.Next != nil && cfg.Next(c) {
			return c.Next()
		}

		// Get origin header preserving the original case for the response

View on GitHub (pinned to 9a4c7e57fe)

Solutions

Enumerate the specific origins that may send credentials: AllowOrigins: []string{"https://app.example.com", "https://admin.example.com"}.
If the allowed set is dynamic, implement AllowOriginsFunc instead of using '*'.
If credentials are not actually required, set AllowCredentials: false (the default) and keep '*'.
Never combine AllowOriginsFunc + AllowCredentials with a function that returns true for every request.

Example fix

// before
cors.New(cors.Config{AllowOrigins: []string{"*"}, AllowCredentials: true})

// after
cors.New(cors.Config{AllowOrigins: []string{"https://app.example.com"}, AllowCredentials: true})

Defensive patterns

Strategy: validation

Validate before calling

func validateCORSConfig(cfg cors.Config) error {
    allowAll := len(cfg.AllowOrigins) == 0 && cfg.AllowOriginsFunc == nil
    for _, o := range cfg.AllowOrigins {
        if o == "*" { allowAll = true }
    }
    if cfg.AllowCredentials && allowAll {
        return errors.New("AllowCredentials cannot be combined with wildcard '*' or empty AllowOrigins")
    }
    return nil
}

if err := validateCORSConfig(cfg); err != nil { log.Fatal(err) }

Prevention

Treat AllowCredentials + '*' as a security review trigger.
Prefer an explicit origin list or a strict AllowOriginsFunc whenever credentials are enabled.

When it happens

Trigger: Calling cors.New(Config{AllowCredentials: true, AllowOrigins: []string{"*"}}), or AllowCredentials: true with no AllowOrigins and no AllowOriginsFunc (which also resolves to allowAllOrigins).

Common situations: Copy-pasting a permissive CORS config and then flipping AllowCredentials on for cookie-based auth. Also: relying on the empty-default (allow all) while adding a Session middleware that needs credentials.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/4a55156abcc8d664.json. Report an issue: GitHub.