{"id":"55c820003c9c22bb","repo":"gofiber/fiber","slug":"csrf-origin-header-invalid","errorCode":null,"errorMessage":"csrf: origin header invalid","messagePattern":"csrf: origin header invalid","errorType":"validation","errorClass":"ErrOriginInvalid","httpStatus":null,"severity":"warning","filePath":"middleware/csrf/csrf.go","lineNumber":28,"sourceCode":"\t\"time\"\n\n\t\"github.com/gofiber/utils/v2\"\n\tutilsstrings \"github.com/gofiber/utils/v2/strings\"\n\n\t\"github.com/gofiber/fiber/v3\"\n\t\"github.com/gofiber/fiber/v3/extractors\"\n\t\"github.com/gofiber/fiber/v3/internal/redact\"\n\t\"github.com/gofiber/fiber/v3/internal/schemehost\"\n\t\"github.com/gofiber/fiber/v3/middleware/logger\"\n)\n\nvar (\n\tErrTokenNotFound    = errors.New(\"csrf: token not found\")\n\tErrTokenInvalid     = errors.New(\"csrf: token invalid\")\n\tErrFetchSiteInvalid = errors.New(\"csrf: sec-fetch-site header invalid\")\n\tErrRefererNotFound  = errors.New(\"csrf: referer header missing\")\n\tErrRefererInvalid   = errors.New(\"csrf: referer header invalid\")\n\tErrRefererNoMatch   = errors.New(\"csrf: referer does not match host or trusted origins\")\n\tErrOriginInvalid    = errors.New(\"csrf: origin header invalid\")\n\tErrOriginNoMatch    = errors.New(\"csrf: origin does not match host or trusted origins\")\n\terrOriginNotFound   = errors.New(\"origin not supplied or is null\") // internal error, will not be returned to the user\n\tdummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.\n\n)\n\nvar registerLogContextTagsOnce sync.Once\n\n// Handler for CSRF middleware\ntype Handler struct {\n\tsessionManager *sessionManager\n\tstorageManager *storageManager\n\tconfig         Config\n}\n\n// The contextKey type is unexported to prevent collisions with context keys defined in\n// other packages.","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/csrf/csrf.go#L10-L46","documentation":"Returned by csrf.originMatchesHost (csrf.go:375) when the Origin header is present on an unsafe-method request but url.Parse fails to parse it. The Origin header is the primary CSRF validation mechanism for unsafe methods; a syntactically invalid Origin cannot be matched against the host or trusted origins, so the request is rejected.","triggerScenarios":"A POST/PUT/PATCH/DELETE request carries an Origin header that url.Parse rejects — malformed scheme, invalid characters, or broken encoding. Browsers always send well-formed Origin values (or 'null'), so this indicates a non-browser client, a corrupting intermediary, or a crafted attack payload.","commonSituations":"API testing tools that set Origin to a non-URL string; a proxy that mangles the Origin header; custom HTTP clients that guess at the header format; deliberate fuzzing/security testing.","solutions":["Log the raw Origin header in your CSRF ErrorHandler to see the exact malformed value.","Fix the client or intermediary producing the invalid Origin so it sends a proper 'scheme://host' value.","If the client is a browser, investigate extensions or security software that rewrite headers."],"exampleFix":"# before\ncurl -H 'Origin: not-a-url' -X POST https://app/api\n# after\ncurl -H 'Origin: https://app.example.com' -X POST https://app/api","handlingStrategy":"validation","validationCode":"// Log the raw Origin to diagnose malformed values\ncsrf.Config{\n  ErrorHandler: func(c fiber.Ctx, err error) error {\n    if errors.Is(err, csrf.ErrOriginInvalid) {\n      log.Printf(\"malformed Origin: %q\", c.Get(fiber.HeaderOrigin))\n    }\n    return c.SendStatus(403)\n  },\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never set Origin to a non-URL value in client code.","Audit intermediaries (proxies, WAFs) that may corrupt the Origin header.","Use Origin instead of Referer where possible to simplify validation."],"tags":["csrf","security","headers","url-parsing"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}