[CORS] Invalid origin format in configuration: ${maskedOrigi

Error message

[CORS] Invalid origin format in configuration: ${maskedOrigin}

What it means

During CORS config validation (cors.go:69-74), an AllowOrigins entry containing the wildcard subdomain marker "://*." is stripped of the wildcard and passed to normalizeOrigin. If normalizeOrigin rejects it (invalid URL parse, empty host, embedded '*', userinfo, path, query, or fragment), the middleware panics at startup so a misconfigured CORS policy never silently allows the wrong origins.

Source

Thrown at middleware/cors/cors.go:73

	// allowOrigins is a set of strings that contains the allowed origins
	// defined in the 'AllowOrigins' configuration.
	allowOrigins := make(map[string]struct{}, len(cfg.AllowOrigins))
	allowSubOrigins := []subdomain{}

	// Validate and normalize static AllowOrigins
	allowAllOrigins := len(cfg.AllowOrigins) == 0 && cfg.AllowOriginsFunc == nil
	for _, origin := range cfg.AllowOrigins {
		if origin == "*" {
			allowAllOrigins = true
			break
		}

		trimmedOrigin := utils.TrimSpace(origin)
		if before, after, found := strings.Cut(trimmedOrigin, "://*."); found {
			withoutWildcard := before + "://" + after
			isValid, normalizedOrigin := normalizeOrigin(withoutWildcard)
			if !isValid {
				panic("[CORS] Invalid origin format in configuration: " + maskValue(trimmedOrigin))
			}
			scheme, host, ok := strings.Cut(normalizedOrigin, "://")
			if !ok {
				panic("[CORS] Invalid origin format after normalization:" + maskValue(trimmedOrigin))
			}
			sd := subdomain{prefix: scheme + "://", suffix: host}
			allowSubOrigins = append(allowSubOrigins, sd)
		} else {
			isValid, normalizedOrigin := normalizeOrigin(trimmedOrigin)
			if !isValid {
				panic("[CORS] Invalid origin format in configuration: " + maskValue(trimmedOrigin))
			}
			allowOrigins[normalizedOrigin] = struct{}{}
		}
	}

	// Validate CORS credentials configuration
	if cfg.AllowCredentials && allowAllOrigins {

View on GitHub (pinned to 9a4c7e57fe)

Solutions

Use the bare wildcard-subdomain form with no path: AllowOrigins: []string{"https://*.example.com"}.
Verify the scheme is present and the host is non-empty after removing the leading '*.'.
If you need path-scoped CORS, enforce it in your handler — CORS origins are scheme+host only.
Log the resolved AllowOrigins value at startup in environments that pull it from env vars to catch empty/misconfigured entries before they panic.

Example fix

// before
cors.New(cors.Config{AllowOrigins: []string{"https://*.example.com/api"}})

// after
cors.New(cors.Config{AllowOrigins: []string{"https://*.example.com"}})

Defensive patterns

Strategy: validation

Validate before calling

// Pre-validate wildcard subdomain origins before cors.New.
import "net/url"

func validWildcardCORSOrigin(o string) bool {
    before, after, found := strings.Cut(o, "://*.")
    if !found { return false }
    if before == "" || after == "" { return false }
    u, err := url.Parse(before + "://" + after)
    return err == nil && u.Host != "" && !strings.Contains(u.Host, "*") &&
        (u.Path == "" || u.Path == "/") && u.RawQuery == "" && u.Fragment == ""
}

for _, o := range cfg.AllowOrigins {
    if strings.Contains(o, "://*.") && !validWildcardCORSOrigin(o) {
        log.Fatalf("invalid CORS wildcard origin: %s", o)
    }
}

Prevention

Standardize wildcard origins as exactly "scheme://*.host" with no path.
Add a unit test that asserts every AllowOrigins entry is accepted by normalizeOrigin at startup.

When it happens

Trigger: Setting AllowOrigins to a malformed wildcard subdomain such as "https://*" (no suffix), "*://*.example.com" (wildcard scheme), "https://*.example.com/admin" (path present), or an entry whose non-wildcard remainder cannot parse as scheme://host.

Common situations: Devs write "https://*.example.com/path" intending to scope CORS to a path, or use a bare "https://*" expecting it to match all subdomains of all domains. Env-var interpolation that produces an empty/placeholder origin also lands here.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/e4fab0dfca6e3116.json. Report an issue: GitHub.