Fix MiddlewareError: echo: middleware returned an error: runtime error: index out of range [0] with length 0 in Echo

This error occurs when an Echo middleware accesses a slice or array element at an index that does not exist, often from parsing headers or path segments that are empty. Fix it by adding bounds checks before accessing slice elements and returning structured error responses from middleware instead of letting panics propagate.

Reading the Stack Trace

Here's what each line means:

• main.TenantMiddleware.func1({0x1029e4f80, 0x14000226000}) /app/middleware/tenant.go:14 +0x198: The TenantMiddleware at line 14 accesses a slice index that is out of bounds, likely from splitting an empty header value.
• runtime.gopanic({0x102840ea0, 0x14000196040}): Go's runtime panics because of the out-of-bounds index access.
• github.com/labstack/echo/v4/middleware.RecoverWithConfig.func1.1({0x1029e4f80, 0x14000226000}): Echo's Recover middleware catches the panic and converts it to a 500 error response.

Common Causes

func TenantMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		parts := strings.Split(c.Request().Host, ".")
		tenant := parts[0] // panic if Host is empty
		c.Set("tenant", tenant)
		return next(c)
	}
}

func AuthMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		token := c.Request().Header.Get("Authorization")
		if token == "" {
			return fmt.Errorf("missing auth token for user service at %s", serviceURL)
		}
		return next(c)
	}
}

e.Use(RoleMiddleware)   // reads "user" from context
e.Use(AuthMiddleware)   // sets "user" in context
// Wrong order: RoleMiddleware runs first, "user" is nil

The Fix

Check that the Host header is present and that splitting it produces enough segments before accessing index 0. Use echo.NewHTTPError to return structured error responses with appropriate HTTP status codes instead of raw Go errors.

func TenantMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		parts := strings.Split(c.Request().Host, ".")
		tenant := parts[0]
		c.Set("tenant", tenant)
		return next(c)
	}
}

func TenantMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		host := c.Request().Host
		if host == "" {
			return echo.NewHTTPError(http.StatusBadRequest, "missing Host header")
		}
		parts := strings.Split(host, ".")
		if len(parts) < 2 {
			return echo.NewHTTPError(http.StatusBadRequest, "invalid tenant in Host header")
		}
		tenant := parts[0]
		c.Set("tenant", tenant)
		return next(c)
	}
}

Testing the Fix

package middleware_test

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/labstack/echo/v4"
	"github.com/stretchr/testify/assert"
)

func TestTenantMiddleware_ValidHost(t *testing.T) {
	e := echo.New()
	handler := TenantMiddleware(func(c echo.Context) error {
		return c.String(200, c.Get("tenant").(string))
	})

	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.Host = "acme.example.com"
	rec := httptest.NewRecorder()
	c := e.NewContext(req, rec)

	err := handler(c)
	assert.NoError(t, err)
	assert.Equal(t, "acme", rec.Body.String())
}

func TestTenantMiddleware_EmptyHost(t *testing.T) {
	e := echo.New()
	handler := TenantMiddleware(func(c echo.Context) error {
		return c.String(200, "ok")
	})

	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.Host = ""
	rec := httptest.NewRecorder()
	c := e.NewContext(req, rec)

	err := handler(c)
	assert.Error(t, err)
	he, ok := err.(*echo.HTTPError)
	assert.True(t, ok)
	assert.Equal(t, http.StatusBadRequest, he.Code)
}

Run your tests:

go test ./middleware/... -v

Pushing Through CI/CD

git checkout -b fix/echo-middleware-error,git add middleware/tenant.go middleware/tenant_test.go,git commit -m "fix: add bounds check and error handling in tenant middleware",git push origin fix/echo-middleware-error

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'
      - run: go mod download
      - run: go vet ./...
      - run: go test ./... -race -coverprofile=coverage.out
      - run: go build ./...

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

go get github.com/bugstack/sdk

import "github.com/bugstack/sdk"

func init() {
  bugstack.Init(os.Getenv("BUGSTACK_API_KEY"))
}

Deploying the Fix (Manual Path)

1. Run go test ./... locally to confirm the fix passes.
2. Open a pull request with the middleware bounds check changes.
3. Wait for CI checks to pass on the PR.
4. Have a teammate review and approve the PR.
5. Merge to main and verify the deployment in staging before promoting to production.

Frequently Asked Questions