{"record":{"id":"709ca301627431b1","repo":"tailscale/tailscale","slug":"csrf-request-denied-with-invalid-origin-q","errorCode":null,"errorMessage":"CSRF request denied with invalid Origin %q","messagePattern":"CSRF request denied with invalid Origin %q","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"client/web/web.go","lineNumber":282,"sourceCode":"\t\t// use the Host header to determine the expected origin\n\t\t// (use the override if set to allow for reverse proxying)\n\t\thost := r.Host\n\t\tif host == \"\" {\n\t\t\thttp.Error(w, \"CSRF request denied with no Host header\", http.StatusForbidden)\n\t\t\treturn\n\t\t}\n\t\tif s.originOverride != \"\" {\n\t\t\thost = s.originOverride\n\t\t}\n\n\t\toriginHeader := r.Header.Get(\"Origin\")\n\t\tif originHeader == \"\" {\n\t\t\thttp.Error(w, \"CSRF request denied with no Origin header\", http.StatusForbidden)\n\t\t\treturn\n\t\t}\n\t\tparsedOrigin, err := url.Parse(originHeader)\n\t\tif err != nil {\n\t\t\thttp.Error(w, fmt.Sprintf(\"CSRF request denied with invalid Origin %q\", r.Header.Get(\"Origin\")), http.StatusForbidden)\n\t\t\treturn\n\t\t}\n\t\torigin := parsedOrigin.Host\n\t\tif origin == \"\" {\n\t\t\thttp.Error(w, \"CSRF request denied with no host in the Origin header\", http.StatusForbidden)\n\t\t\treturn\n\t\t}\n\n\t\tif origin != host {\n\t\t\thttp.Error(w, fmt.Sprintf(\"CSRF request denied with mismatched Origin %q and Host %q\", origin, host), http.StatusForbidden)\n\t\t\treturn\n\t\t}\n\n\t\th.ServeHTTP(w, r)\n\n\t})\n}\n","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/client/web/web.go#L264-L300","documentation":"Sent as a 403 by the web client's CSRF middleware when the request's Origin header cannot be parsed as a URL. The request is rejected before reaching the API handler.","triggerScenarios":"Thrown at client/web/web.go:282 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the raw Origin header for corruption or encoding errors","Fix the client/proxy generating the malformed Origin","Reject at the proxy layer before reaching the web client"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}