{"record":{"id":"8f0af6d583885b42","repo":"caddyserver/caddy","slug":"buggy-browser-is-sending-null-origin-header","errorCode":null,"errorMessage":"Buggy browser is sending null Origin header.","messagePattern":"Buggy browser is sending null Origin header\\.","errorType":"http","errorClass":"APIError","httpStatus":400,"severity":"error","filePath":"admin.go","lineNumber":849,"sourceCode":"\t\treturn\n\t}\n\tif strings.Contains(r.Header.Get(\"Sec-Fetch-Mode\"), \"no-cors\") {\n\t\t// turns out web pages can just disable the same-origin policy (!???!?)\n\t\t// but at least browsers let us know that's the case, holy heck\n\t\th.handleError(w, r, APIError{\n\t\t\tHTTPStatus: http.StatusBadRequest,\n\t\t\tErr:        errors.New(\"client attempted to make request by disabling same-origin policy using no-cors mode\"),\n\t\t\tMessage:    \"Disabling same-origin restrictions is not allowed.\",\n\t\t})\n\t\treturn\n\t}\n\tif r.Header.Get(\"Origin\") == \"null\" {\n\t\t// bug in Firefox in certain cross-origin situations (yikes?)\n\t\t// (not strictly a security vuln on its own, but it's red flaggy,\n\t\t// since it seems to manifest in cross-origin contexts)\n\t\th.handleError(w, r, APIError{\n\t\t\tHTTPStatus: http.StatusBadRequest,\n\t\t\tErr:        errors.New(\"invalid origin 'null'\"),\n\t\t\tMessage:    \"Buggy browser is sending null Origin header.\",\n\t\t})\n\t\treturn\n\t}\n\n\tif h.enforceHost {\n\t\t// DNS rebinding mitigation\n\t\terr := h.checkHost(r)\n\t\tif err != nil {\n\t\t\th.handleError(w, r, err)\n\t\t\treturn\n\t\t}\n\t}\n\n\t_, hasOriginHeader := r.Header[\"Origin\"]\n\t_, hasSecHeader := r.Header[\"Sec-Fetch-Mode\"]\n\tif h.enforceOrigin || hasOriginHeader || hasSecHeader {\n\t\t// cross-site mitigation","sourceCodeStart":831,"sourceCodeEnd":867,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/admin.go#L831-L867","documentation":"loadSTEK() returned an error other than fs.ErrNotExist while reading the persisted STEK from storage. The provider distinguishes 'no keys yet' (fine, will create) from any other read failure (a real problem), and this error is the latter.","triggerScenarios":"storage.Load on the STEK key returns a non-ErrNotExist error: storage backend unreachable, permission denied on the key file, or gob decoding of a corrupt/truncated persisted STEK fails.","commonSituations":"Corrupted storage after a crash mid-write; partially synced distributed storage (S3 eventual consistency anomalies); permission changes on the data directory; Redis flushing/failing between the lock and the load.","solutions":["Inspect the wrapped error to see if it is a connectivity/permission failure (fix storage) versus a decode failure (corrupt data).","For corrupt local data, stop Caddy and delete the STEK key from the data directory (it lives under the storage root; deleting it forces clean regeneration — only session resumption is lost).","For remote storage, restore backend health and restart Caddy.","Verify all cluster instances run compatible Caddy versions so the gob encoding of distributedSTEK matches."],"exampleFix":"// before: corrupt stek key file in storage\nls /var/lib/caddy/locks  # locate storage keys\n\n# after: stop caddy, remove the stek entry, restart to regenerate\nsystemctl stop caddy\nrm -rf /var/lib/caddy/stek*  # path depends on storage layout\nsystemctl start caddy","handlingStrategy":"retry","validationCode":null,"typeGuard":"// Distinguish 'no keys yet' (benign) from real load failures when implementing custom storage:\n_, err := storage.Load(ctx, stekKeyName)\nif errors.Is(err, fs.ErrNotExist) { /* first run: ok */ } else if err != nil { /* real failure */ }","tryCatchPattern":"On this error, inspect errors.Is/As on the chain: fs.ErrNotExist is handled internally, so any surfaced error is a genuine storage fault — remediate storage, then restart to retry the load.","preventionTips":["Use storage backends with atomic writes to avoid truncated STEK data.","Keep cluster members on the same Caddy version so gob schemas match.","Back up the data directory before upgrades.","Do not hand-edit files under Caddy's storage."],"tags":["caddy","caddytls","stek","storage","corruption"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}