What causes "can not parse %s: %w" in labstack/echo?

Trim whitespace and validate each origin with url.Parse before configuring the middleware.

can not parse %s: %w

Error message

can not parse %s: %w

What it means

Returned by validateOrigin() (util.go:121) when url.Parse(origin) fails for a configured origin string. validateOrigin is used by CORS (cors.go:185) and CSRF (csrf.go:153) middleware to validate AllowOrigins / TrustedOrigins entries. The '%s' is the 'what' label (e.g. 'allow origin', 'trusted origin').

Source

Thrown at middleware/util.go:121

				return string(b[:length])
			}
		}
	}
}

func validateOrigins(origins []string, what string) error {
	for _, o := range origins {
		if err := validateOrigin(o, what); err != nil {
			return err
		}
	}
	return nil
}

func validateOrigin(origin string, what string) error {
	u, err := url.Parse(origin)
	if err != nil {
		return fmt.Errorf("can not parse %s: %w", what, err)
	}
	if u.Scheme == "" || u.Host == "" {
		return fmt.Errorf("%s is missing scheme or host: %s", what, origin)
	}
	if u.Path != "" || u.RawQuery != "" || u.Fragment != "" {
		return fmt.Errorf("%s can not have path, query, and fragments: %s", what, origin)
	}
	return nil
}

View on GitHub (pinned to 05489dc173)

Solutions

Trim whitespace and validate each origin with url.Parse before configuring the middleware.
Use the standard 'scheme://host' form (e.g. 'https://example.com').
Sanitize config-sourced origin lists at startup.
For wildcard needs use '*' in CORS AllowOrigins rather than malformed entries.

Example fix

// before
origins := strings.Split(os.Getenv("ORIGINS"), ",") // may include spaces/newlines
cfg := middleware.CORSConfig{AllowOrigins: origins}
// after
var clean []string
for _, o := range strings.Split(os.Getenv("ORIGINS"), ",") {
    if o = strings.TrimSpace(o); o != "" {
        clean = append(clean, o)
    }
}
cfg := middleware.CORSConfig{AllowOrigins: clean}

Defensive patterns

Strategy: validation

Validate before calling

func cleanOrigins(raw []string) ([]string, error) {
    var out []string
    for _, o := range raw {
        o = strings.TrimSpace(o)
        if o == "" { continue }
        if _, err := url.Parse(o); err != nil {
            return nil, fmt.Errorf("invalid origin %q: %w", o, err)
        }
        out = append(out, o)
    }
    return out, nil
}

Prevention

Sanitize origin lists sourced from env/config: trim whitespace, drop empties.
Validate with url.Parse before passing to CORS/CSRF middleware.
Use '*' for CORS wildcard rather than malformed entries.

When it happens

Trigger: Passing an origin string to CORS AllowOrigins or CSRF TrustedOrigins that url.Parse rejects: control characters, backslashes in the scheme, or otherwise malformed URLs. This is caught at middleware construction (ToMiddleware).

Common situations: Loading origins from an environment variable or config file that contains stray whitespace/control chars; typos like 'http//example.com'; copy-paste artifacts; origins with spaces.

Related errors

AI-assisted analysis of labstack/echo@05489dc173 (2026-08-04). Data as JSON: /data/errors/d998d8f028470c18.json. Report an issue: GitHub.