[CORS] Invalid origin format after normalization:${maskedOri

Error message

[CORS] Invalid origin format after normalization:${maskedOrigin}

What it means

A defensive panic in the CORS wildcard-subdomain branch (cors.go:75-78). After normalizeOrigin succeeds it splits the normalized origin on "://" to obtain scheme and host for the subdomain matcher; if that Cut fails it indicates normalizeOrigin returned a value without a scheme separator, which should be unreachable. Surfacing it as a panic prevents a corrupted entry from being stored as a subdomain matcher that matches nothing or everything.

Source

Thrown at middleware/cors/cors.go:77

	// Validate and normalize static AllowOrigins
	allowAllOrigins := len(cfg.AllowOrigins) == 0 && cfg.AllowOriginsFunc == nil
	for _, origin := range cfg.AllowOrigins {
		if origin == "*" {
			allowAllOrigins = true
			break
		}

		trimmedOrigin := utils.TrimSpace(origin)
		if before, after, found := strings.Cut(trimmedOrigin, "://*."); found {
			withoutWildcard := before + "://" + after
			isValid, normalizedOrigin := normalizeOrigin(withoutWildcard)
			if !isValid {
				panic("[CORS] Invalid origin format in configuration: " + maskValue(trimmedOrigin))
			}
			scheme, host, ok := strings.Cut(normalizedOrigin, "://")
			if !ok {
				panic("[CORS] Invalid origin format after normalization:" + maskValue(trimmedOrigin))
			}
			sd := subdomain{prefix: scheme + "://", suffix: host}
			allowSubOrigins = append(allowSubOrigins, sd)
		} else {
			isValid, normalizedOrigin := normalizeOrigin(trimmedOrigin)
			if !isValid {
				panic("[CORS] Invalid origin format in configuration: " + maskValue(trimmedOrigin))
			}
			allowOrigins[normalizedOrigin] = struct{}{}
		}
	}

	// Validate CORS credentials configuration
	if cfg.AllowCredentials && allowAllOrigins {
		panic("[CORS] Configuration error: When 'AllowCredentials' is set to true, 'AllowOrigins' cannot contain a wildcard origin '*'. Please specify allowed origins explicitly or adjust 'AllowCredentials' setting.")
	}

	// Warn if allowAllOrigins is set to true and AllowOriginsFunc is defined

View on GitHub (pinned to 9a4c7e57fe)

Solutions

If you are a user (not editing the cors package), the real culprit is almost certainly error 262 or 264 — double-check the exact AllowOrigins entry; this line should not be the top frame.
If you are editing cors/utils.go normalizeOrigin, ensure it always returns 'scheme://host' for valid origins.
Report the offending origin string and the cors package version as a bug; include the stack trace.

Defensive patterns

Strategy: try-catch

Try / catch

// This line is effectively unreachable for end users; wrap middleware
// construction in recover during config bootstrap to surface a clear message.
func mustNewCORS(cfg cors.Config) cors.Handler {
    defer func() {
        if r := recover(); r != nil {
            log.Fatalf("cors.New panicked (likely error 262/264): %v", r)
        }
    }()
    return cors.New(cfg)
}

Prevention

If you see this specific line as the top frame, treat it as a bug in your fork of cors and check normalizeOrigin.
Keep cors package at a released version rather than an edited checkout.

When it happens

Trigger: Effectively unreachable under normal use; would only fire if normalizeOrigin's contract changed to return a host-only string, or if a future edit to the normalization logic produced an origin without "://". In practice you will not hit this unless you are editing the cors package internals.

Common situations: Encountered only when forking or contributing to the cors middleware and changing normalizeOrigin. Not a configuration error a user can trigger with a normal AllowOrigins value.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/e1be7128f4d55902.json. Report an issue: GitHub.