gofiber/fiber · error

[CORS] Invalid origin format in configuration:

Error message

[CORS] Invalid origin format in configuration: 

What it means

In the CORS middleware, an AllowOrigins entry containing the wildcard-subdomain marker '://*.' (e.g. 'https://*.example.com') is rewritten by removing the wildcard and then validated via normalizeOrigin. If normalizeOrigin rejects it (unparseable URL, userinfo present, empty host, embedded '*' in host, or a path/query/fragment other than a root '/'), the config is invalid and CORS startup panics. The offending value is masked in the message (maskValue) to avoid leaking secrets embedded in origins.

Source

Thrown at middleware/cors/cors.go:73

	// allowOrigins is a set of strings that contains the allowed origins
	// defined in the 'AllowOrigins' configuration.
	allowOrigins := make(map[string]struct{}, len(cfg.AllowOrigins))
	allowSubOrigins := []subdomain{}

	// Validate and normalize static AllowOrigins
	allowAllOrigins := len(cfg.AllowOrigins) == 0 && cfg.AllowOriginsFunc == nil
	for _, origin := range cfg.AllowOrigins {
		if origin == "*" {
			allowAllOrigins = true
			break
		}

		trimmedOrigin := utils.TrimSpace(origin)
		if before, after, found := strings.Cut(trimmedOrigin, "://*."); found {
			withoutWildcard := before + "://" + after
			isValid, normalizedOrigin := normalizeOrigin(withoutWildcard)
			if !isValid {
				panic("[CORS] Invalid origin format in configuration: " + maskValue(trimmedOrigin))
			}
			scheme, host, ok := strings.Cut(normalizedOrigin, "://")
			if !ok {
				panic("[CORS] Invalid origin format after normalization:" + maskValue(trimmedOrigin))
			}
			sd := subdomain{prefix: scheme + "://", suffix: host}
			allowSubOrigins = append(allowSubOrigins, sd)
		} else {
			isValid, normalizedOrigin := normalizeOrigin(trimmedOrigin)
			if !isValid {
				panic("[CORS] Invalid origin format in configuration: " + maskValue(trimmedOrigin))
			}
			allowOrigins[normalizedOrigin] = struct{}{}
		}
	}

	// Validate CORS credentials configuration
	if cfg.AllowCredentials && allowAllOrigins {

View on GitHub (pinned to a105acad6c)

Solutions

1. For wildcard subdomains use the exact form 'https://*.example.com' with no path, query, fragment, or port on the wildcard portion.
2. If you need to allow specific paths, do it in your handler/route logic, not in AllowOrigins (origins are scheme+host only).
3. Validate each AllowOrigins entry with net/url.Parse before constructing the Config.

Example fix

// before
cors.New(cors.Config{ AllowOrigins: []string{"https://*.example.com/api"} })
// after
cors.New(cors.Config{ AllowOrigins: []string{"https://*.example.com"} })

func validWildcardOrigin(o string) bool {
    before, after, found := strings.Cut(strings.TrimSpace(o), "://*.")
    if !found {
        return false
    }
    u, err := url.Parse(before + "://" + after)
    if err != nil || u.User != nil || u.Host == "" ||
        strings.Contains(u.Host, "*") ||
        (u.Path != "" && u.Path != "/") || u.RawQuery != "" || u.Fragment != "" {
        return false
    }
    return true
}
for _, o := range cfg.AllowOrigins {
    if strings.Contains(o, "://*.") && !validWildcardOrigin(o) {
        return fmt.Errorf("invalid wildcard origin %q", o)
    }
}

defer func() {
    if r := recover(); r != nil {
        log.Fatalf("CORS origin rejected: %v", r)
    }
}()
cors.New(cfg)

When it happens

Trigger: cors.New(cors.Config{ AllowOrigins: []string{"https://*.example.com/path", "https://*:8080", "https://*." } }) — any '://*.' origin whose non-wildcard portion fails normalizeOrigin. Examples: missing host after the wildcard, an appended path/query, a port attached to the wildcard, or a fragment.

Common situations: Typing a path or port after a wildcard subdomain ('https://*.app.com/api'); using 'https://*' (wildcard with no base domain); embedding credentials/userinfo; copy-pasting a full Origin header that includes a trailing path or query.

Related errors

• [CSRF] Invalid origin format in configuration:
• basicauth: charset must be UTF-8
• [CORS] Invalid origin format after normalization:
• [CORS] Configuration error: When 'AllowCredentials' is set t
• fiber: encrypt cookie middleware requires key

AI-assisted analysis of gofiber/fiber@a105acad6c (2026-08-11). Data as JSON: /api/errors/72efadadee629022. Report an issue: GitHub.