Admin cross-origin

Identifiers

Field	Value
Type URI	https://echo.labstack.com/pro/problems/admin-cross-origin
Code	admin_cross_origin
HTTP status	403

HTTP status	English title
403	Forbidden

When it occurs

The request failed the console’s origin checks. Every request is checked against configured origins. POST requests must also pass http.CrossOriginProtection.

Client handling

Open the console from its configured origin, and do not submit console forms from other sites.

Example response

If your application installs a custom handler, the body may differ.

HTTP/1.1 403 Forbidden
Content-Type: application/problem+json
Cache-Control: no-store

{
  "code": "admin_cross_origin",
  "detail": "",
  "status": 403,
  "title": "Forbidden",
  "type": "https://echo.labstack.com/pro/problems/admin-cross-origin"
}

Server correction

Set Config.Origins and Config.PublicPath to the deployed values. Make outer middleware pass console requests to the console’s origin and CSRF checks.

Response fields

Admin console

• code (string, always): The stable code above.
• detail (string, always): The console always sends detail. It is often empty and never contains the underlying error.
• status (integer, always): The HTTP status of the response.
• title (string, always): The HTTP status text, such as Conflict, unless the panel supplies its own title.
• type (string, always): The exact type URI above.

Headers:

• Cache-Control (always): no-store. The console sends it on every problem response, along with its usual security headers.

Notes:

• Fields are written in alphabetical order.
• The console rewrites every 404 response to admin_not_found with an empty detail.

Related behavior

See the admin console for access checks, action IDs and audit failures.