caddyserver/caddy · error · APIError

Disabling same-origin restrictions is not allowed.

Error message

Disabling same-origin restrictions is not allowed.

What it means

No session ticket key set existed in storage (fs.ErrNotExist from loadSTEK), so the provider tried to generate a fresh STEK via rotateKeys, and that rotation failed. rotateKeys both generates new keys and persists them to storage, so the failure is either key generation or a storage write (Store) problem.

Source

Thrown at admin.go:838

	// common mitigations in browser contexts
	if strings.Contains(r.Header.Get("Upgrade"), "websocket") {
		// I've never been able demonstrate a vulnerability myself, but apparently
		// WebSocket connections originating from browsers aren't subject to CORS
		// restrictions, so we'll just be on the safe side
		h.handleError(w, r, APIError{
			HTTPStatus: http.StatusBadRequest,
			Err:        errors.New("websocket connections aren't allowed"),
			Message:    "WebSocket connections aren't allowed.",
		})
		return
	}
	if strings.Contains(r.Header.Get("Sec-Fetch-Mode"), "no-cors") {
		// turns out web pages can just disable the same-origin policy (!???!?)
		// but at least browsers let us know that's the case, holy heck
		h.handleError(w, r, APIError{
			HTTPStatus: http.StatusBadRequest,
			Err:        errors.New("client attempted to make request by disabling same-origin policy using no-cors mode"),
			Message:    "Disabling same-origin restrictions is not allowed.",
		})
		return
	}
	if r.Header.Get("Origin") == "null" {
		// bug in Firefox in certain cross-origin situations (yikes?)
		// (not strictly a security vuln on its own, but it's red flaggy,
		// since it seems to manifest in cross-origin contexts)
		h.handleError(w, r, APIError{
			HTTPStatus: http.StatusBadRequest,
			Err:        errors.New("invalid origin 'null'"),
			Message:    "Buggy browser is sending null Origin header.",
		})
		return
	}

	if h.enforceHost {
		// DNS rebinding mitigation

View on GitHub (pinned to 50e54ee279)

Solutions

1. Check the wrapped error: 'storing STEK gob' indicates a storage write problem — verify the data directory is writable or the remote storage is reachable.
2. Run with a writable volume for Caddy's data storage (e.g. mount /data in Docker and set the storage path).
3. Fix the underlying storage issue and restart; on next startup getSTEK will retry creation.
4. If running a cluster, ensure all instances use the same storage so only one node creates keys and others load them.

Example fix

# before: container with read-only storage
 docker run caddy

# after: give a writable volume
docker run -v caddy_data:/data caddy

// Verify storage is writable before first start:
f := filepath.Join(dataDir, ".write-test")
if err := os.WriteFile(f, []byte("ok"), 0o600); err != nil {
    return fmt.Errorf("data dir not writable: %w", err)
}
os.Remove(f)

Wrap Initialize in a startup gate: fail fast with a clear message instead of letting Caddy serve without STEKs; the error already chains the storage cause.

When it happens

Trigger: First run on a cluster (empty storage) combined with: storage.Store failing on the STEK key path (read-only volume, permissions, backend outage), or crypto/rand being unavailable (very rare, entropy exhaustion).

Common situations: Fresh deployments where the data directory is not writable; read-only containers (containers run with a read-only root filesystem and no writable volume for the data dir); a remote storage backend that is down at first start.

Related errors

• WebSocket connections aren't allowed.
• Buggy browser is sending null Origin header.
• syntax error: unexpected token '%s', expecting '%s', at %s:%
• --input is required
• --output is required

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/6d59b25c4aff9bbd. Report an issue: GitHub.