hostauthorization: invalid host ${h} — subdomain wildcards u

Error message

hostauthorization: invalid host ${h} — subdomain wildcards use the "*.example.com" form

What it means

When parsing AllowedHosts, hostauthorization rejects entries that begin with a dot (e.g. ".example.com"). Some other tools use the leading-dot form for subdomain matching, but this middleware requires the explicit "*.example.com" wildcard form so wildcard intent is unambiguous and the hot-path suffix check stays simple. Note the message interpolates the host verbatim (it concatenates h), so the literal offending entry appears in the panic.

Source

Thrown at middleware/hostauthorization/hostauthorization.go:41

}

// parseAllowedHosts splits AllowedHosts into exact and wildcard groups,
// normalizing entries (port strip, lowercase, IDN→Punycode) and enforcing
// RFC 1035 length limits. Panics on misconfiguration so it surfaces at startup.
func parseAllowedHosts(hosts []string) parsedHosts {
	parsed := parsedHosts{
		exact: make(map[string]struct{}, len(hosts)),
	}

	for _, h := range hosts {
		h = utils.TrimSpace(h)
		if h == "" {
			continue
		}

		// Reject the leading-dot form some other tools use; we want "*.example.com".
		if len(h) > 1 && h[0] == '.' {
			panic("hostauthorization: invalid host " + h + " — subdomain wildcards use the \"*.example.com\" form")
		}

		isWildcard := strings.HasPrefix(h, "*.")
		if isWildcard {
			h = h[2:]
		}

		h = normalizeHost(h)
		if h == "" {
			continue
		}

		validateHostLength(h)

		if isWildcard {
			// Stored with leading dot so the hot-path HasSuffix check stays alloc-free.
			parsed.wildcardSuffixes = append(parsed.wildcardSuffixes, "."+h)
		} else {

View on GitHub (pinned to a105acad6c)

Solutions

Convert ".example.com" to "*.example.com" to match all subdomains.
If you also need the apex matched, list both: "example.com" and "*.example.com" (the wildcard does NOT match the bare domain).
Strip leading dots programmatically only if you intend exact host matching, not wildcard matching.

Example fix

// before
hostauthorization.New(hostauthorization.Config{
    AllowedHosts: []string{".example.com"},
})

// after
hostauthorization.New(hostauthorization.Config{
    AllowedHosts: []string{"example.com", "*.example.com"},
})

Defensive patterns

Strategy: validation

Validate before calling

func normalizeAllowedHosts(in []string) []string {
    out := make([]string, 0, len(in))
    for _, h := range in {
        h = strings.TrimSpace(h)
        if strings.HasPrefix(h, ".") {
            h = "*" + h // convert ".example.com" -> "*.example.com"
        }
        if h != "" {
            out = append(out, h)
        }
    }
    return out
}

Prevention

Use the "*.example.com" wildcard form consistently; reject leading-dot entries in your config validator.
When importing allowlists from other tools, run a normalization pass.
List both apex and wildcard if you need both matched.

When it happens

Trigger: AllowedHosts: []string{".example.com"} or any entry whose first character is '.' and length > 1. Often happens when migrating allowlists from nginx/CORS-style configs that use a leading dot.

Common situations: Copying a domain allowlist from a CORS or cookie-domain config (which frequently use .example.com); bulk-importing hostnames from a spreadsheet that prefixes subdomain entries with a dot; legacy config ported from another framework.

Related errors

AI-assisted analysis of gofiber/fiber@a105acad6c (2026-08-11). Data as JSON: /api/errors/b68ee671afbf718e. Report an issue: GitHub.