hostauthorization: host %q has label %q exceeding RFC 1035 l

Error message

hostauthorization: host %q has label %q exceeding RFC 1035 limit of %d characters (%d chars)

What it means

RFC 1035 caps each label (the text between dots) at 63 characters. validateHostLength (hostauthorization.go:76-80) iterates labels via SplitSeq and panics when any single label exceeds maxLabelLength (63). IPv6 hosts (which contain ':') skip the per-label check because their structure is not dotted labels.

Source

Thrown at middleware/hostauthorization/hostauthorization.go:78

			parsed.exact[h] = struct{}{}
		}
	}

	return parsed
}

func validateHostLength(host string) {
	if len(host) > maxDomainLength {
		panic(fmt.Sprintf("hostauthorization: host %q exceeds RFC 1035 maximum of %d characters (%d chars)",
			host, maxDomainLength, len(host)))
	}
	// IPv6 hosts contain colons and aren't dotted labels.
	if strings.IndexByte(host, ':') >= 0 {
		return
	}
	for label := range strings.SplitSeq(host, ".") {
		if len(label) > maxLabelLength {
			panic(fmt.Sprintf("hostauthorization: host %q has label %q exceeding RFC 1035 limit of %d characters (%d chars)",
				host, label, maxLabelLength, len(label)))
		}
	}
}

// normalizeHost strips port, trailing dot, and IPv6 brackets, lowercases,
// and converts IDN labels to Punycode (matching what browsers send).
func normalizeHost(host string) string {
	// Fast path for plain hostnames — avoids net.SplitHostPort's error allocation.
	if host != "" && host[0] != '[' && strings.IndexByte(host, ':') < 0 {
		host = trimOneTrailingDot(host)
		host = utilsstrings.ToLower(host)
		return toPunycode(host)
	}

	if h, _, err := net.SplitHostPort(host); err == nil {
		host = h
	} else {

View on GitHub (pinned to 9a4c7e57fe)

Solutions

Shorten the offending label to 63 characters or fewer; truncate or hash long identifiers.
For IDN domains, check the Punycode length, not the unicode length.
Validate generated hostnames against the 63-byte label limit before storing them as allowed hosts.

Example fix

// before
AllowedHosts: []string{"thisLabelIsWayTooLongToBeValidUnderRFC1035RulesBecauseItExceedsSixtyThreeChars.example.com"}

// after
AllowedHosts: []string{"short.example.com"} // each label <= 63 chars

Defensive patterns

Strategy: validation

Validate before calling

const maxLabel = 63

func validateHostLabelLengths(hosts []string) error {
    for _, h := range hosts {
        if strings.HasPrefix(h, "*.") { h = h[2:] }
        if strings.Contains(h, ":") { continue } // IPv6
        for _, label := range strings.Split(h, ".") {
            if len(label) > maxLabel {
                return fmt.Errorf("label %q in %q is %d chars, exceeds RFC 1035 max %d",
                    label, h, len(label), maxLabel)
            }
        }
    }
    return nil
}

if err := validateHostLabelLengths(cfg.AllowedHosts); err != nil { log.Fatal(err) }

Prevention

Validate generated tenant/host identifiers against the 63-byte label limit.
Check Punycode length for IDN labels, not the unicode length.

When it happens

Trigger: An AllowedHosts entry containing a single label longer than 63 characters, e.g. "a-very-long-single-label-without-any-dots-that-exceeds-sixty-three-characters.example.com".

Common situations: Generated/host-derived hostnames where one segment (a tenant id, hash, or slug) is unusually long, or IDN labels whose Punycode form ('xn--' + encoded) exceeds 63 bytes even though the unicode form looked short.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/a28f8d6f06c3e018.json. Report an issue: GitHub.