# AssertionError: allow_origins must be a list or tuple of strings

- **ID:** `python/fastapi-cors-middleware-misconfiguration`
- **Domain:** python
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The CORS middleware expects allow_origins as a list, but a string or other type is provided.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (100% success)
   ```
   Use a list: allow_origins=["*"] or allow_origins=["https://example.com"]
   ```
2. **** (95% success)
   ```
   Use allow_origin_regex for pattern matching: allow_origin_regex="https?://.*"
   ```

## Dead Ends

- **** — Starlette's CORSMiddleware requires a list, even for wildcard. (100% fail)
- **** — The assertion checks each element is a string, so non-strings cause failure. (90% fail)