gofiber/fiber · critical

hostauthorization: AllowedHosts or AllowedHostsFunc is requi

Error message

hostauthorization: AllowedHosts or AllowedHostsFunc is required

What it means

The hostauthorization middleware exists to allowlist Host header values; with neither AllowedHosts nor AllowedHostsFunc set it would have nothing to check and every request would either be rejected or allowed (depending on defaults). configDefault (config.go:56-58) panics when AllowedHosts is empty AND AllowedHostsFunc is nil so that the middleware is never deployed in a no-op state.

Source

Thrown at middleware/hostauthorization/config.go:57

	// Entries are normalized at startup: port stripped, trailing dot removed,
	// lowercased, IDN labels converted to Punycode, RFC 1035 length limits enforced
	// (≤253 total / ≤63 per-label).
	//
	// Required if AllowedHostsFunc is nil.
	AllowedHosts []string
}

// ConfigDefault is the default config.
var ConfigDefault = Config{}

func configDefault(config ...Config) Config {
	cfg := ConfigDefault
	if len(config) > 0 {
		cfg = config[0]
	}

	if len(cfg.AllowedHosts) == 0 && cfg.AllowedHostsFunc == nil {
		panic("hostauthorization: AllowedHosts or AllowedHostsFunc is required")
	}

	if cfg.ErrorHandler == nil {
		cfg.ErrorHandler = func(c fiber.Ctx, _ error) error {
			return c.SendStatus(fiber.StatusForbidden)
		}
	}

	return cfg
}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Provide an explicit allowlist: hostauthorization.Config{AllowedHosts: []string{"example.com", "*.example.com"}}.
2. For dynamic host sets, implement AllowedHostsFunc to return the permitted list per request.
3. Load AllowedHosts from config and fail app startup if the resulting slice is empty.

Example fix

// before
hostauthorization.New(hostauthorization.Config{})

// after
hostauthorization.New(hostauthorization.Config{
    AllowedHosts: []string{"example.com", "www.example.com"},
})

func validateHostAuthConfig(cfg hostauthorization.Config) error {
    if len(cfg.AllowedHosts) == 0 && cfg.AllowedHostsFunc == nil {
        return errors.New("AllowedHosts or AllowedHostsFunc is required")
    }
    return nil
}

if err := validateHostAuthConfig(cfg); err != nil { log.Fatal(err) }

When it happens

Trigger: Calling hostauthorization.New(hostauthorization.Config{}) with no AllowedHosts slice and no AllowedHostsFunc. Also when AllowedHosts is loaded from an env var that resolves to an empty slice.

Common situations: Adding hostauthorization for security hardening but forgetting to populate AllowedHosts in non-production environments, or a config struct left at zero values during a refactor.

Related errors

• hostauthorization: invalid host ${host} — subdomain wildcard
• hostauthorization: host %q exceeds RFC 1035 maximum of %d ch
• [CORS] Invalid origin format in configuration: ${maskedOrigi
• fiber: encrypt cookie middleware requires key
• helmet: HSTSMaxAge must be greater than or equal to 0

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/6dd646d19b4ae8b3.json. Report an issue: GitHub.