+
+
+
+
High performance, extensible, minimalist Go web framework.
Echo v4 maintenance line
+ 
+ 
+ 
+ 
+ 
+
+ v4 API reference · + Upgrade to v5 · + Website (v5) · + Discussions · + Commercial support +
+ +## About This branch holds Echo v4, the maintenance line. Echo v5 is the current release; start new projects on [v5](https://github.com/labstack/echo). -- [v4 API reference](https://pkg.go.dev/github.com/labstack/echo/v4) -- [Upgrade from v4 to v5](https://github.com/labstack/echo/blob/master/API_CHANGES_V5.md) -- [Website](https://echo.labstack.com) (documents v5) -- Community help: [GitHub Discussions](https://github.com/labstack/echo/discussions) -- Commercial support: [Echo Support](https://echo.labstack.com/pro#support) - ### Support Echo v4 receives bug fixes until 2026-12-31 and free security fixes until 2027-12-31, on its latest release only. It gets no new features. See [SECURITY.md](https://github.com/labstack/echo/blob/master/SECURITY.md) for the full policy. @@ -29,6 +42,8 @@ Echo v4 requires Go 1.26 or later (since v4.16.1), to use patched `golang.org/x/ ### Client IP security migration since v4.16.3 +> **Important:** Behind a proxy, set `Echo#IPExtractor` before you upgrade to v4.16.3. Otherwise all clients behind the proxy share one IP address for rate limiting, access controls and logging. + Echo v4.16.3 changes client IP defaults. Without `Echo#IPExtractor`, `Context.RealIP()` uses the connection peer and ignores `X-Forwarded-For` and `X-Real-IP`. Proxy middleware always replaces upstream `X-Real-IP` with this result. This fixes [CVE-2026-118651](https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36) and [CVE-2026-118653](https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq). Applications that already set `Echo#IPExtractor` keep their behavior. A custom rate-limit identifier that does not call `RealIP()` is also unaffected. Behind a proxy, configure `Echo#IPExtractor` before starting the server. Otherwise, clients behind the same proxy share its IP address for rate limiting, access controls and logging. Use `echo.ExtractIPDirect()` when there is no proxy. For proxies that set `X-Forwarded-For`, turn off the broad default trust ranges and trust only your proxy addresses: @@ -125,6 +140,14 @@ func hello(c echo.Context) error { } ``` +Run it and send a request: + +```console +$ go run . +$ curl http://localhost:8080/ +Hello, World! +``` + ## Official middleware The Echo team maintains these repositories. @@ -137,6 +160,9 @@ The Echo team maintains these repositories. ## Third-party middleware +