# Feature catalog — labstack/echo

> Canonical page: https://codevetter.com/unpack/echo/feature-catalog

# Feature catalog — labstack/echo

Scanned commit 99c395d846e079d4cffd29de9298d1dd829e8b04 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Echo exposes developer-facing APIs rather than a fixed collection of application screens or business routes. Its features cover routing, input conversion, output formats, static content, security policies, traffic management, and observability. Middleware is explicitly installed by consuming applications, and configuration factories allow customization. The catalog below groups the inspected capabilities; the investigation is bounded rather than exhaustive.
- Routing supports HTTP method helpers including QUERY, custom method registration, Any/Match, fallback routes, nested groups, and named route reversal. NewVirtualHostHandler dispatches exact request Host matches to separate Echo instances, falling back to its own routes. — [echo.go#L534-L626](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/echo.go#L534-L626) [group.go#L137-L143](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/group.go#L137-L143) [route.go#L82-L136](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/route.go#L82-L136) [vhost.go#L8-L19](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/vhost.go#L8-L19)
- Input APIs bind path, query, header, JSON, XML, URL-encoded form, and multipart data. ValueBinder provides fluent source-specific conversion with fail-fast or accumulated errors, while generic PathParam/QueryParam helpers distinguish missing values from empty values. — [bind.go#L43-L140](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/bind.go#L43-L140) [binder.go#L112-L223](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/binder.go#L112-L223) [binder_generic.go#L48-L122](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/binder_generic.go#L48-L122)
- Context supports HTML, text, JSON, validated JSONP, XML, blobs, streaming, attachments, inline files, redirects, and empty responses; Render delegates to a configured template renderer. Error output can use the default JSON handler or RFC 9457 Problem Details. — [context.go#L474-L506](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/context.go#L474-L506) [context.go#L509-L610](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/context.go#L509-L610) [context.go#L637-L768](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/context.go#L637-L768) [rfc9457.go#L49-L64](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/rfc9457.go#L49-L64) [echo.go#L458-L517](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/echo.go#L458-L517)
- Static and StaticFS register filesystem-backed GET routes; File/FileFS expose individual files. Static middleware additionally offers configurable index files, directory browsing, group-base handling, and HTML5 index fallback restricted to router-level 404 errors. — [echo.go#L629-L652](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/echo.go#L629-L652) [echo.go#L705-L731](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/echo.go#L705-L731) [middleware/static.go#L24-L84](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/static.go#L24-L84) [middleware/static.go#L278-L335](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/static.go#L278-L335)
- Security middleware includes callback-driven BasicAuth and KeyAuth, CSRF protection using fetch metadata or cookie/token comparison, configured CORS origins, and Secure headers such as CSP and HSTS. CORS rejects wildcard origins with credentials unless custom origin logic is supplied. — [middleware/basic_auth.go#L97-L155](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/basic_auth.go#L97-L155) [middleware/key_auth.go#L138-L204](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/key_auth.go#L138-L204) [middleware/csrf.go#L168-L259](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/csrf.go#L168-L259) [middleware/csrf.go#L264-L310](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/csrf.go#L264-L310) [middleware/cors.go#L171-L189](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/cors.go#L171-L189) [middleware/secure.go#L127-L151](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/secure.go#L127-L151)
- Traffic APIs provide token-bucket rate limiting with custom stores and response headers, reverse proxying with random or round-robin balancing, retries, rewrites, custom transports, response modification, and WebSocket forwarding. StartConfig supplies HTTP/TLS listener and shutdown controls. — [middleware/rate_limiter.go#L124-L165](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/rate_limiter.go#L124-L165) [middleware/rate_limiter.go#L263-L300](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/rate_limiter.go#L263-L300) [middleware/proxy.go#L29-L104](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/proxy.go#L29-L104) [middleware/proxy.go#L370-L411](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/proxy.go#L370-L411) [server.go#L25-L60](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/server.go#L25-L60)
- Request transformation middleware includes method override, wildcard/regex rewrites, trailing-slash normalization, and HTTPS/www redirects. Payload middleware supplies configurable gzip responses, gzip request decompression with a default 100 MiB expansion limit, BodyLimit, and cooperative ContextTimeout handling. — [middleware/method_override.go#L35-L78](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/method_override.go#L35-L78) [middleware/rewrite.go#L14-L34](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/rewrite.go#L14-L34) [middleware/slash.go#L25-L76](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/slash.go#L25-L76) [middleware/slash.go#L102-L141](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/slash.go#L102-L141) [middleware/redirect.go#L33-L80](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/redirect.go#L33-L80) [middleware/redirect.go#L104-L145](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/redirect.go#L104-L145) [middleware/compress.go#L24-L65](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/compress.go#L24-L65) [middleware/decompress.go#L24-L62](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/decompress.go#L24-L62) [middleware/body_limit.go#L49-L76](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/body_limit.go#L49-L76) [middleware/context_timeout.go#L38-L70](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/context_timeout.go#L38-L70)
- RequestLogger offers selectable request/response fields and a default slog callback; RequestID propagates or generates an ID in response headers. BodyDump calls an application callback with payloads and handler errors, while Recover converts ordinary panics into returned errors and rethrows http.ErrAbortHandler. — [middleware/request_logger.go#L128-L177](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/request_logger.go#L128-L177) [middleware/request_logger.go#L394-L425](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/request_logger.go#L394-L425) [middleware/request_id.go#L53-L71](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/request_id.go#L53-L71) [middleware/body_dump.go#L111-L141](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/body_dump.go#L111-L141) [middleware/recover.go#L68-L85](https://github.com/labstack/echo/blob/99c395d846e079d4cffd29de9298d1dd829e8b04/middleware/recover.go#L68-L85)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)