hostauthorization: invalid host ${host} — subdomain wildcard

Error message

hostauthorization: invalid host ${host} — subdomain wildcards use the "*.example.com" form

What it means

Some tools (e.g. Django's ALLOWED_HOSTS) accept a leading-dot form like ".example.com" to mean subdomains. This middleware requires the explicit "*.example.com" wildcard syntax for subdomain matching and rejects leading-dot entries (hostauthorization.go:40-42) to avoid ambiguity about whether the apex domain is included.

Source

Thrown at middleware/hostauthorization/hostauthorization.go:41

}

// parseAllowedHosts splits AllowedHosts into exact and wildcard groups,
// normalizing entries (port strip, lowercase, IDN→Punycode) and enforcing
// RFC 1035 length limits. Panics on misconfiguration so it surfaces at startup.
func parseAllowedHosts(hosts []string) parsedHosts {
	parsed := parsedHosts{
		exact: make(map[string]struct{}, len(hosts)),
	}

	for _, h := range hosts {
		h = utils.TrimSpace(h)
		if h == "" {
			continue
		}

		// Reject the leading-dot form some other tools use; we want "*.example.com".
		if len(h) > 1 && h[0] == '.' {
			panic("hostauthorization: invalid host " + h + " — subdomain wildcards use the \"*.example.com\" form")
		}

		isWildcard := strings.HasPrefix(h, "*.")
		if isWildcard {
			h = h[2:]
		}

		h = normalizeHost(h)
		if h == "" {
			continue
		}

		validateHostLength(h)

		if isWildcard {
			// Stored with leading dot so the hot-path HasSuffix check stays alloc-free.
			parsed.wildcardSuffixes = append(parsed.wildcardSuffixes, "."+h)
		} else {

View on GitHub (pinned to 9a4c7e57fe)

Solutions

Rewrite leading-dot entries as "*.example.com" for subdomain matching.
If you also need the apex domain, list it separately: []string{"example.com", "*.example.com"}.
Audit lists migrated from Nginx/Django configs for leading-dot entries.

Example fix

// before
hostauthorization.Config{AllowedHosts: []string{".example.com"}}

// after
hostauthorization.Config{AllowedHosts: []string{"example.com", "*.example.com"}}

Defensive patterns

Strategy: validation

Validate before calling

func normalizeAllowedHostsSyntax(hosts []string) ([]string, error) {
    out := make([]string, 0, len(hosts))
    for _, h := range hosts {
        if strings.HasPrefix(h, ".") {
            return nil, fmt.Errorf("host %q uses leading-dot form; use %q instead", h, "*"+h)
        }
        out = append(out, h)
    }
    return out, nil
}

hosts, err := normalizeAllowedHostsSyntax(cfg.AllowedHosts)
if err != nil { log.Fatal(err) }

Prevention

When migrating from other frameworks, audit for leading-dot entries.
List apex and wildcard subdomains separately to be explicit.

When it happens

Trigger: Passing AllowedHosts entries such as ".example.com" (leading dot). The apex domain must be listed separately because "*.example.com" matches subdomains only.

Common situations: Porting an allowed-hosts list from another framework that uses leading-dot syntax, or assuming the leading dot matches the bare domain.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/5895dd5765407784.json. Report an issue: GitHub.