gofiber/fiber · critical

helmet: HSTSMaxAge must be greater than or equal to 0

Error message

helmet: HSTSMaxAge must be greater than or equal to 0

What it means

HSTSMaxAge (seconds) is emitted in the Strict-Transport-Security header; a negative value is nonsensical and would be rejected by browsers. configDefault (helmet/config.go:109-111) panics when HSTSMaxAge < 0 so the header is never emitted with an invalid duration. Zero is allowed and disables the max-age directive.

Source

Thrown at middleware/helmet/config.go:110

	CrossOriginResourcePolicy: "same-origin",
	OriginAgentCluster:        "?1",
	XDNSPrefetchControl:       "off",
	XDownloadOptions:          "noopen",
	XPermittedCrossDomain:     "none",
}

// Helper function to set default values
func configDefault(config ...Config) Config {
	// Return default config if nothing provided
	if len(config) < 1 {
		return ConfigDefault
	}

	// Override default config
	cfg := config[0]

	if cfg.HSTSMaxAge < 0 {
		panic("helmet: HSTSMaxAge must be greater than or equal to 0")
	}

	if cfg.HSTSPreloadEnabled && cfg.HSTSExcludeSubdomains {
		panic("helmet: HSTSPreloadEnabled requires HSTSExcludeSubdomains to be false")
	}

	// Set default values
	if cfg.XSSProtection == "" {
		cfg.XSSProtection = ConfigDefault.XSSProtection
	}

	if cfg.ContentTypeNosniff == "" {
		cfg.ContentTypeNosniff = ConfigDefault.ContentTypeNosniff
	}

	if cfg.XFrameOptions == "" {
		cfg.XFrameOptions = ConfigDefault.XFrameOptions
	}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Set HSTSMaxAge to a positive number of seconds (e.g. 63072000 for two years) or 0 to disable.
2. Compute it explicitly: HSTSMaxAge: int((2 * 365 * 24 * time.Hour).Seconds()).
3. Grep your config for any arithmetic that could yield a negative value.

Example fix

// before
helmet.New(helmet.Config{HSTSMaxAge: -1})

// after
helmet.New(helmet.Config{HSTSMaxAge: 63072000}) // 2 years

func validateHSTSMaxAge(age int) error {
    if age < 0 { return errors.New("HSTSMaxAge must be >= 0") }
    return nil
}

if err := validateHSTSMaxAge(cfg.HSTSMaxAge); err != nil { log.Fatal(err) }

When it happens

Trigger: Passing helmet.Config{HSTSMaxAge: -1} (or any negative int). Often a calculation error such as subtracting a desired duration from a base value, or an uninitialized int32 field set to a sentinel.

Common situations: Computing HSTSMaxAge from a time.Duration and forgetting to convert, e.g. HSTSMaxAge: int(-time.Since(someTime)), or copying a config that used -1 as 'unset' in another library.

Related errors

• helmet: HSTSPreloadEnabled requires HSTSExcludeSubdomains to
• [CORS] Invalid origin format in configuration: ${maskedOrigi
• fiber: encrypt cookie middleware requires key
• hostauthorization: AllowedHosts or AllowedHostsFunc is requi
• hostauthorization: invalid host ${host} — subdomain wildcard

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/e762b6c032609be6.json. Report an issue: GitHub.