{"record":{"id":"6d59b25c4aff9bbd","repo":"caddyserver/caddy","slug":"disabling-same-origin-restrictions-is-not-allowed","errorCode":null,"errorMessage":"Disabling same-origin restrictions is not allowed.","messagePattern":"Disabling same-origin restrictions is not allowed\\.","errorType":"http","errorClass":"APIError","httpStatus":400,"severity":"error","filePath":"admin.go","lineNumber":838,"sourceCode":"\n\t// common mitigations in browser contexts\n\tif strings.Contains(r.Header.Get(\"Upgrade\"), \"websocket\") {\n\t\t// I've never been able demonstrate a vulnerability myself, but apparently\n\t\t// WebSocket connections originating from browsers aren't subject to CORS\n\t\t// restrictions, so we'll just be on the safe side\n\t\th.handleError(w, r, APIError{\n\t\t\tHTTPStatus: http.StatusBadRequest,\n\t\t\tErr:        errors.New(\"websocket connections aren't allowed\"),\n\t\t\tMessage:    \"WebSocket connections aren't allowed.\",\n\t\t})\n\t\treturn\n\t}\n\tif strings.Contains(r.Header.Get(\"Sec-Fetch-Mode\"), \"no-cors\") {\n\t\t// turns out web pages can just disable the same-origin policy (!???!?)\n\t\t// but at least browsers let us know that's the case, holy heck\n\t\th.handleError(w, r, APIError{\n\t\t\tHTTPStatus: http.StatusBadRequest,\n\t\t\tErr:        errors.New(\"client attempted to make request by disabling same-origin policy using no-cors mode\"),\n\t\t\tMessage:    \"Disabling same-origin restrictions is not allowed.\",\n\t\t})\n\t\treturn\n\t}\n\tif r.Header.Get(\"Origin\") == \"null\" {\n\t\t// bug in Firefox in certain cross-origin situations (yikes?)\n\t\t// (not strictly a security vuln on its own, but it's red flaggy,\n\t\t// since it seems to manifest in cross-origin contexts)\n\t\th.handleError(w, r, APIError{\n\t\t\tHTTPStatus: http.StatusBadRequest,\n\t\t\tErr:        errors.New(\"invalid origin 'null'\"),\n\t\t\tMessage:    \"Buggy browser is sending null Origin header.\",\n\t\t})\n\t\treturn\n\t}\n\n\tif h.enforceHost {\n\t\t// DNS rebinding mitigation","sourceCodeStart":820,"sourceCodeEnd":856,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/admin.go#L820-L856","documentation":"No session ticket key set existed in storage (fs.ErrNotExist from loadSTEK), so the provider tried to generate a fresh STEK via rotateKeys, and that rotation failed. rotateKeys both generates new keys and persists them to storage, so the failure is either key generation or a storage write (Store) problem.","triggerScenarios":"First run on a cluster (empty storage) combined with: storage.Store failing on the STEK key path (read-only volume, permissions, backend outage), or crypto/rand being unavailable (very rare, entropy exhaustion).","commonSituations":"Fresh deployments where the data directory is not writable; read-only containers (containers run with a read-only root filesystem and no writable volume for the data dir); a remote storage backend that is down at first start.","solutions":["Check the wrapped error: 'storing STEK gob' indicates a storage write problem — verify the data directory is writable or the remote storage is reachable.","Run with a writable volume for Caddy's data storage (e.g. mount /data in Docker and set the storage path).","Fix the underlying storage issue and restart; on next startup getSTEK will retry creation.","If running a cluster, ensure all instances use the same storage so only one node creates keys and others load them."],"exampleFix":"# before: container with read-only storage\n docker run caddy\n\n# after: give a writable volume\ndocker run -v caddy_data:/data caddy","handlingStrategy":"validation","validationCode":"// Verify storage is writable before first start:\nf := filepath.Join(dataDir, \".write-test\")\nif err := os.WriteFile(f, []byte(\"ok\"), 0o600); err != nil {\n    return fmt.Errorf(\"data dir not writable: %w\", err)\n}\nos.Remove(f)","typeGuard":null,"tryCatchPattern":"Wrap Initialize in a startup gate: fail fast with a clear message instead of letting Caddy serve without STEKs; the error already chains the storage cause.","preventionTips":["Mount a writable volume for /data in containers.","Do not run Caddy with a read-only data directory when the distributed STEK module is enabled.","Share one storage backend across the cluster so only the first node creates keys."],"tags":["caddy","caddytls","stek","storage","first-run"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}