kataras/iris · warning

origin not allowed

Error message

origin not allowed

What it means

ErrOriginNotAllowed is returned by the CORS middleware's handler when the request's Origin header does not pass the configured origin-allow check. It is handed to the user-supplied error handler so the developer can decide the response; by default the middleware disallows cross-origin requests from unregistered origins.

Source

Thrown at middleware/cors/cors.go:21

import (
	"errors"
	"net/http"
	"regexp"
	"strconv"
	"strings"
	"time"

	"github.com/kataras/iris/v12/context"
)

func init() {
	context.SetHandlerName("iris/middleware/cors.*", "iris.cors")
}

var (
	// ErrOriginNotAllowed is given to the error handler
	// when the error is caused because an origin was not allowed to pass through.
	ErrOriginNotAllowed = errors.New("origin not allowed")

	// AllowAnyOrigin allows all origins to pass.
	AllowAnyOrigin = func(_ *context.Context, _ string) bool {
		return true
	}

	// DefaultErrorHandler is the default error handler which
	// fires forbidden status (403) on disallowed origins.
	DefaultErrorHandler = func(ctx *context.Context, _ error) {
		ctx.StopWithStatus(http.StatusForbidden)
	}

	// DefaultOriginExtractor is the default method which
	// an origin is extracted. It returns the value of the request's "Origin" header
	// and always true, means that it allows empty origin headers as well.
	DefaultOriginExtractor = func(ctx *context.Context) (string, bool) {
		header := ctx.GetHeader(originRequestHeader)
		return header, true

View on GitHub (pinned to 7bedaf55a0)

Solutions

1. Register the missing origin in the CORS options' AllowedOrigins or supply an AllowOriginFunc that accepts it.
2. Use cors.AllowAnyOrigin (only for public APIs / dev) if all origins should pass.
3. Make sure the exact origin including scheme and port matches, e.g. 'http://localhost:3000'.
4. Handle ErrOriginNotAllowed in the custom error handler to return a proper 403 response.

Example fix

// before
c := cors.New()

// after
c := cors.New(cors.Options{
    AllowedOrigins: []string{"https://myapp.com", "http://localhost:3000"},
})

const allowed = ['https://myapp.com', 'http://localhost:3000'];
if (!allowed.includes(window.location.origin)) {
  throw new Error(`Origin ${window.location.origin} not in server CORS allowlist`);
}

// server-side handler
h := cors.New().AllowOriginFunc(...)
app.WrapRouter(func(w http.ResponseWriter, r *http.Request) {
    // inside the cors error handler:
    if errors.Is(err, cors.ErrOriginNotAllowed) {
        ctx.StatusCode(http.StatusForbidden)
        return
    }
})

When it happens

Trigger: A browser sends a cross-origin request with Origin: https://evil.com (or any origin not in the allowed list) to a route wrapped with cors.New(); the AllowOriginFunc returns false and the error handler receives ErrOriginNotAllowed.

Common situations: Forgetting to add the frontend's production or localhost origin to the allowed origins; deploying to a new domain without updating CORS config; using the strict default check while AllowAnyOrigin was expected.

Related errors

• compress: response will not be compressed
• empty form field
• precondition failed
• compress: request is not compressed
• compress: unsupported compression

AI-assisted analysis of kataras/iris@7bedaf55a0 (2026-08-30). Data as JSON: /api/errors/16d557f25de0c22e. Report an issue: GitHub.