The CrossOriginProtection.AddInsecureBypassPattern method of the net/http package panics if the given pattern conflicts with one that is already bypassed.
This could be inferred from the method's documentation, which states:
The pattern syntax and precedence rules are the same as [ServeMux](https://pkg.go.dev/net/http@go1.25.0#ServeMux).
However, in the ServeMux documentation it is explicitly noted that ServeMux.Handle and ServeMux.HandleFunc may panic, while this is not mentioned for CrossOriginProtection.AddInsecureBypassPattern.
I suggest updating the documentation of both AddInsecureBypassPattern and ServeMux to clearly indicate which methods may panic in case of a conflict.
Comment From: gabyhelp
Related Issues
Related Documentation
(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)
Comment From: prattmic
cc @FiloSottile @golang/security
Comment From: neild
Seems reasonable to me.
Comment From: colegarien
Hi, I’d like to take this issue. I’ve prepared a PR here that updates the doc comments on ServeMux.Handle, ServeMux.HandleFunc, and CrossOriginProtection.AddInsecureBypassPattern to explicitly mention panic conditions for both conflicts and invalid patterns.
Comment From: gopherbot
Change https://go.dev/cl/701016 mentions this issue: net/http: clarify panic conditions in Handle, HandleFunc, AddInsecureBypassPattern