gofiber/fiber · critical

helmet: HSTSPreloadEnabled requires HSTSExcludeSubdomains to

Error message

helmet: HSTSPreloadEnabled requires HSTSExcludeSubdomains to be false

What it means

The HSTS preload list (hstspreload.org) requires that preloaded domains include subdomains — you cannot submit a domain for preload while excluding subdomains. configDefault (helmet/config.go:113-115) panics when both HSTSPreloadEnabled and HSTSExcludeSubdomains are true, preventing a header combination the preload list would reject.

Source

Thrown at middleware/helmet/config.go:114

	XPermittedCrossDomain:     "none",
}

// Helper function to set default values
func configDefault(config ...Config) Config {
	// Return default config if nothing provided
	if len(config) < 1 {
		return ConfigDefault
	}

	// Override default config
	cfg := config[0]

	if cfg.HSTSMaxAge < 0 {
		panic("helmet: HSTSMaxAge must be greater than or equal to 0")
	}

	if cfg.HSTSPreloadEnabled && cfg.HSTSExcludeSubdomains {
		panic("helmet: HSTSPreloadEnabled requires HSTSExcludeSubdomains to be false")
	}

	// Set default values
	if cfg.XSSProtection == "" {
		cfg.XSSProtection = ConfigDefault.XSSProtection
	}

	if cfg.ContentTypeNosniff == "" {
		cfg.ContentTypeNosniff = ConfigDefault.ContentTypeNosniff
	}

	if cfg.XFrameOptions == "" {
		cfg.XFrameOptions = ConfigDefault.XFrameOptions
	}

	if cfg.ReferrerPolicy == "" {
		cfg.ReferrerPolicy = ConfigDefault.ReferrerPolicy
	}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. If you want preload, set HSTSExcludeSubdomains: false so all subdomains are covered.
2. If you must exclude subdomains, set HSTSPreloadEnabled: false.
3. Ensure HSTSMaxAge is at least 1 year (31536000) before enabling preload — the preload list requires it.

Example fix

// before
helmet.New(helmet.Config{HSTSPreloadEnabled: true, HSTSExcludeSubdomains: true})

// after
helmet.New(helmet.Config{
    HSTSMaxAge:            31536000,
    HSTSPreloadEnabled:    true,
    HSTSExcludeSubdomains: false,
})

func validateHelmetPreload(cfg helmet.Config) error {
    if cfg.HSTSPreloadEnabled && cfg.HSTSExcludeSubdomains {
        return errors.New("HSTSPreloadEnabled requires HSTSExcludeSubdomains=false")
    }
    if cfg.HSTSPreloadEnabled && cfg.HSTSMaxAge < 31536000 {
        return errors.New("HSTS preload requires MaxAge >= 1 year (31536000)")
    }
    return nil
}

if err := validateHelmetPreload(cfg); err != nil { log.Fatal(err) }

When it happens

Trigger: Setting helmet.Config{HSTSPreloadEnabled: true, HSTSExcludeSubdomains: true}. The combination is invalid per the HSTS preload submission requirements.

Common situations: Turning on preload for SEO/security hardening while keeping HSTSExcludeSubdomains true from a previous config that hosts untrusted subdomains. Also: copy-pasting a hardened config without reconciling the two flags.

Related errors

• helmet: HSTSMaxAge must be greater than or equal to 0
• [CORS] Invalid origin format in configuration: ${maskedOrigi
• fiber: encrypt cookie middleware requires key
• hostauthorization: AllowedHosts or AllowedHostsFunc is requi
• hostauthorization: invalid host ${host} — subdomain wildcard

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/03c044cb4beb19ef.json. Report an issue: GitHub.