# AssertionError: 'allow_origins' must be a list of strings or a single string

- **ID:** `python/fastapi-cors-middleware-origin`
- **Domain:** python
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

Passing an invalid type to CORSMiddleware allow_origins, such as a set or tuple.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (100% success)
   ```
   Use a list: allow_origins=['*'] or allow_origins=['http://example.com']
   ```
2. **** (80% success)
   ```
   If you need dynamic origins, use a function that returns a list
   ```

## Dead Ends

- **** — FastAPI expects a list; set is not accepted. (90% fail)
- **** — It's allowed but may cause issues with credentials; the assertion is for non-string types. (30% fail)