{"record":{"id":"8e2bdd79853062f5","repo":"gofiber/fiber","slug":"csrf-invalid-origin-format-in-configuration","errorCode":null,"errorMessage":"[CSRF] Invalid origin format in configuration:","messagePattern":"\\[CSRF\\] Invalid origin format in configuration:","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/csrf/csrf.go","lineNumber":91,"sourceCode":"\tvar sessionManager *sessionManager\n\tvar storageManager *storageManager\n\tif cfg.Session != nil {\n\t\tsessionManager = newSessionManager(cfg.Session)\n\t} else {\n\t\tstorageManager = newStorageManager(cfg.Storage, redactKeys)\n\t}\n\n\t// Pre-parse trusted origins\n\ttrustedOrigins := []string{}\n\ttrustedSubOrigins := []subdomain{}\n\n\tfor _, origin := range cfg.TrustedOrigins {\n\t\ttrimmedOrigin := utils.TrimSpace(origin)\n\t\tif i := strings.Index(trimmedOrigin, \"://*.\"); i != -1 {\n\t\t\twithoutWildcard := trimmedOrigin[:i+len(\"://\")] + trimmedOrigin[i+len(\"://*.\"):]\n\t\t\tisValid, normalizedOrigin := normalizeOrigin(withoutWildcard)\n\t\t\tif !isValid {\n\t\t\t\tpanic(\"[CSRF] Invalid origin format in configuration:\" + maskValue(origin))\n\t\t\t}\n\t\t\tschemeSep := strings.Index(normalizedOrigin, \"://\") + len(\"://\")\n\t\t\tsd := subdomain{prefix: normalizedOrigin[:schemeSep], suffix: normalizedOrigin[schemeSep:]}\n\t\t\ttrustedSubOrigins = append(trustedSubOrigins, sd)\n\t\t} else {\n\t\t\tisValid, normalizedOrigin := normalizeOrigin(trimmedOrigin)\n\t\t\tif !isValid {\n\t\t\t\tpanic(\"[CSRF] Invalid origin format in configuration:\" + maskValue(origin))\n\t\t\t}\n\t\t\ttrustedOrigins = append(trustedOrigins, normalizedOrigin)\n\t\t}\n\t}\n\n\t// Create the handler outside of the returned function\n\thandler := &Handler{\n\t\tconfig:         cfg,\n\t\tsessionManager: sessionManager,\n\t\tstorageManager: storageManager,","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/gofiber/fiber/blob/a105acad6c1e4576a77f01e02973f67e962bb58d/middleware/csrf/csrf.go#L73-L109","documentation":"The CSRF middleware pre-parses cfg.TrustedOrigins for origin validation. An entry containing '://*.' (wildcard subdomain) is de-wildcarded and passed to normalizeOrigin; if that returns invalid (unparseable URL, embedded '*' in host, userinfo, empty host, or a non-root path/query/fragment), CSRF startup panics with the masked original value.","triggerScenarios":"csrf.New(csrf.Config{ TrustedOrigins: []string{\"https://*.example.com/api\", \"https://*.\", \"https://*:8443\"} }) — any wildcard-subdomain origin whose de-wildcarded form fails normalizeOrigin (e.g. trailing path, missing host, port on the wildcard).","commonSituations":"Listing a trusted SPA origin with its path; using a wildcard with no base domain; pasting a full Origin header (with path/query) into TrustedOrigins; mixing port and wildcard forms.","solutions":["Use the exact form 'https://*.example.com' with no path, query, fragment, or wildcard-port suffix.","If a specific port is needed, attach it to a non-wildcard origin: 'https://api.example.com:8443'.","Pre-validate TrustedOrigins entries with net/url.Parse before building the Config."],"exampleFix":"// before\ncsrf.New(csrf.Config{ TrustedOrigins: []string{\"https://*.app.com/login\"} })\n// after\ncsrf.New(csrf.Config{ TrustedOrigins: []string{\"https://*.app.com\"} })","handlingStrategy":"validation","validationCode":"func validTrustedWildcard(o string) bool {\n    t := strings.TrimSpace(o)\n    i := strings.Index(t, \"://*.\")\n    if i < 0 {\n        return false\n    }\n    base := t[:i+len(\"://\")] + t[i+len(\"://*.\"):]\n    u, err := url.Parse(base)\n    if err != nil || u.User != nil || u.Host == \"\" || strings.Contains(u.Host, \"*\") ||\n        (u.Path != \"\" && u.Path != \"/\") || u.RawQuery != \"\" || u.Fragment != \"\" {\n        return false\n    }\n    return true\n}\nfor _, o := range cfg.TrustedOrigins {\n    if strings.Contains(o, \"://*.\") && !validTrustedWildcard(o) {\n        return fmt.Errorf(\"invalid trusted wildcard origin %q\", o)\n    }\n}","typeGuard":null,"tryCatchPattern":"defer func() {\n    if r := recover(); r != nil {\n        log.Fatalf(\"CSRF trusted origin rejected: %v\", r)\n    }\n}()\ncsrf.New(cfg)","preventionTips":["Format trusted wildcard origins as 'https://*.example.com' only.","Attach ports to concrete origins, not to wildcards.","Validate TrustedOrigins with url.Parse before constructing the Config."],"tags":["middleware","csrf","config","validation","security","startup"],"backgroundTag":null,"analyzedSha":"a105acad6c1e4576a77f01e02973f67e962bb58d","analyzedAt":"2026-08-11T17:33:26.942Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}