Domain pattern '%s' contains invalid parameter name '%s' wit

Error message

Domain pattern '%s' contains invalid parameter name '%s' with character '%c'

What it means

Panics from domain.go:102 when a domain parameter name contains a character outside the allowed set (ASCII a-z, A-Z, 0-9, underscore, hyphen). DNS-safe names keep matching and DomainParam lookups predictable; non-ASCII or punctuation in a param name is rejected.

Source

Thrown at domain.go:102

	for i, part := range parts {
		// Validate no empty labels (e.g., "example..com" is invalid)
		if part == "" {
			panic(fmt.Sprintf("Domain pattern '%s' contains empty label at position %d", pattern, i))
		}

		if part[0] == ':' {
			// Validate parameter name is not empty
			if len(part) == 1 {
				panic(fmt.Sprintf("Domain pattern '%s' contains empty parameter name at position %d", pattern, i))
			}
			paramName := part[1:]
			// Validate parameter name contains only ASCII-safe characters (a-z, A-Z, 0-9, underscore, hyphen).
			// Using explicit ASCII ranges rather than unicode.IsLetter/IsDigit to reject non-ASCII
			// characters that are invalid in DNS names.
			for _, ch := range paramName {
				if !isASCIIAlphanumeric(ch) && ch != '_' && ch != '-' {
					panic(fmt.Sprintf("Domain pattern '%s' contains invalid parameter name '%s' with character '%c'", pattern, paramName, ch))
				}
			}
			m.paramIdx = append(m.paramIdx, i)
			m.paramNames = append(m.paramNames, paramName) // preserve original case
			m.parts[i] = part                              // keep ":param" marker for matching
		} else {
			// Only lowercase constant labels (RFC 4343)
			// Enforce RFC 1035 per-label length limit (63 characters)
			if len(part) > 63 {
				panic(fmt.Sprintf("Domain pattern '%s' has label '%s' exceeding RFC 1035 limit of 63 characters (%d chars)",
					pattern, part, len(part)))
			}
			// Validate label contains only valid ASCII domain characters (a-z, 0-9, hyphen).
			normalized := utilsstrings.ToLower(part)
			for _, ch := range normalized {
				if !isASCIIAlphanumeric(ch) && ch != '-' {
					panic(fmt.Sprintf("Domain pattern '%s' contains invalid character '%c' in label '%s'", pattern, ch, part))
				}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

Restrict parameter names to [A-Za-z0-9_-]; sanitize or reject input used as a param name.
Use a fixed, safe parameter name and capture the variable part at match time via DomainParam.
Validate with a regex like ^[A-Za-z0-9_-]+$ before constructing the pattern.

Example fix

// before
name := r.URL.Query().Get("name") // could be "foo bar"
app.Domain(":" + name + ".example.com").Get("/", h)

// after
name := r.URL.Query().Get("name")
if !paramNameRe.MatchString(name) {
    return fmt.Errorf("invalid domain parameter name")
}
app.Domain(":" + name + ".example.com").Get("/", h)

Defensive patterns

Strategy: validation

Validate before calling

var paramNameRe = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
for _, label := range strings.Split(pattern, ".") {
    if strings.HasPrefix(label, ":") && !paramNameRe.MatchString(label[1:]) {
        return fmt.Errorf("invalid domain parameter name: %s", label[1:])
    }
}
app.Domain(pattern).Get("/", h)

Type guard

func isValidParamName(name string) bool {
    for _, ch := range name {
        if !((ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch == '_' || ch == '-') {
            return false
        }
    }
    return name != ""
}

Prevention

Never inject raw user input as a parameter name.
Constrain parameter names to [A-Za-z0-9_-] at the source.
Use fixed parameter names and read values via DomainParam.

When it happens

Trigger: app.Domain(":user-id.example.com") is fine (hyphen allowed); app.Domain(":us/r.example.com") panics on '/'; app.Domain(":user.example.com") with a unicode char or space in the name panics. Reachable when parameter names are built from untrusted input.

Common situations: Using tenant IDs or emails as parameter names that include '@', '/', spaces, or unicode; templating that injects raw user input into the pattern.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/d59749cec25c9950.json. Report an issue: GitHub.