labstack/echo · error

%s can not have path, query, and fragments: %s

Error message

%s can not have path, query, and fragments: %s

What it means

Returned by validateOrigin() (util.go:127) when an origin parses to a valid scheme+host but ALSO carries a path, query, or fragment. Security origins must be bare 'scheme://host[:port]'; any path/query/fragment is rejected because origin matching is scheme+host only.

Source

Thrown at middleware/util.go:127

func validateOrigins(origins []string, what string) error {
	for _, o := range origins {
		if err := validateOrigin(o, what); err != nil {
			return err
		}
	}
	return nil
}

func validateOrigin(origin string, what string) error {
	u, err := url.Parse(origin)
	if err != nil {
		return fmt.Errorf("can not parse %s: %w", what, err)
	}
	if u.Scheme == "" || u.Host == "" {
		return fmt.Errorf("%s is missing scheme or host: %s", what, origin)
	}
	if u.Path != "" || u.RawQuery != "" || u.Fragment != "" {
		return fmt.Errorf("%s can not have path, query, and fragments: %s", what, origin)
	}
	return nil
}

View on GitHub (pinned to 05489dc173)

Solutions

1. Strip path, query, and fragment from every origin: keep only 'scheme://host[:port]'.
2. Use url.Parse and reconstruct with only Scheme+Host (and Host:Port) if needed.
3. Remember CORS origins are scheme+host+port only — never paths.

Example fix

// before
cfg := middleware.CORSConfig{AllowOrigins: []string{"https://app.example.com/dashboard"}}
// after
cfg := middleware.CORSConfig{AllowOrigins: []string{"https://app.example.com"}}

func requireBareOrigins(origins []string) error {
    for _, o := range origins {
        u, err := url.Parse(o)
        if err != nil { return err }
        if u.Path != "" || u.RawQuery != "" || u.Fragment != "" {
            return fmt.Errorf("origin %q must not contain path/query/fragment", o)
        }
    }
    return nil
}

When it happens

Trigger: Configuring an origin like 'https://example.com/api', 'https://example.com?x=1', or 'https://example.com#section' in CORS AllowOrigins or CSRF TrustedOrigins. The presence of u.Path, u.RawQuery, or u.Fragment trips this check.

Common situations: Copying a full URL instead of an origin from documentation; appending API paths to the origin string; misunderstanding that CORS origins never include paths.

Related errors

• can not parse %s: %w
• %s is missing scheme or host: %s
• at least one AllowOrigins is required or UnsafeAllowOriginFu
• timeout must be set
• * as allowed origin and AllowCredentials=true is insecure an

AI-assisted analysis of labstack/echo@05489dc173 (2026-08-04). Data as JSON: /data/errors/f0d7eb7c328ef914.json. Report an issue: GitHub.