{"id":"595658bd924d6083","repo":"gofiber/fiber","slug":"csrf-referer-header-invalid","errorCode":null,"errorMessage":"csrf: referer header invalid","messagePattern":"csrf: referer header invalid","errorType":"validation","errorClass":"ErrRefererInvalid","httpStatus":null,"severity":"warning","filePath":"middleware/csrf/csrf.go","lineNumber":26,"sourceCode":"\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/gofiber/utils/v2\"\n\tutilsstrings \"github.com/gofiber/utils/v2/strings\"\n\n\t\"github.com/gofiber/fiber/v3\"\n\t\"github.com/gofiber/fiber/v3/extractors\"\n\t\"github.com/gofiber/fiber/v3/internal/redact\"\n\t\"github.com/gofiber/fiber/v3/internal/schemehost\"\n\t\"github.com/gofiber/fiber/v3/middleware/logger\"\n)\n\nvar (\n\tErrTokenNotFound    = errors.New(\"csrf: token not found\")\n\tErrTokenInvalid     = errors.New(\"csrf: token invalid\")\n\tErrFetchSiteInvalid = errors.New(\"csrf: sec-fetch-site header invalid\")\n\tErrRefererNotFound  = errors.New(\"csrf: referer header missing\")\n\tErrRefererInvalid   = errors.New(\"csrf: referer header invalid\")\n\tErrRefererNoMatch   = errors.New(\"csrf: referer does not match host or trusted origins\")\n\tErrOriginInvalid    = errors.New(\"csrf: origin header invalid\")\n\tErrOriginNoMatch    = errors.New(\"csrf: origin does not match host or trusted origins\")\n\terrOriginNotFound   = errors.New(\"origin not supplied or is null\") // internal error, will not be returned to the user\n\tdummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.\n\n)\n\nvar registerLogContextTagsOnce sync.Once\n\n// Handler for CSRF middleware\ntype Handler struct {\n\tsessionManager *sessionManager\n\tstorageManager *storageManager\n\tconfig         Config\n}\n","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/csrf/csrf.go#L8-L44","documentation":"Returned by csrf.refererMatchesHost (csrf.go:408) when the Referer header is present on an HTTPS unsafe-method request (and Origin is absent) but url.Parse fails to parse it. This indicates the Referer value is syntactically malformed and cannot be interpreted as a URL, so origin matching is impossible.","triggerScenarios":"An HTTPS state-changing request carries a Referer header that url.Parse rejects — e.g. containing invalid escape sequences, control characters, or a malformed scheme. Browsers never produce such values, so this points to a buggy client, a corrupting proxy, or a hand-crafted request.","commonSituations":"A reverse proxy or WAF that rewrites/corrupts the Referer header; a client library that sets Referer to a non-URL value; manual curl testing with a typo in the Referer; encoding issues in header forwarding between tiers.","solutions":["Inspect the raw Referer header the server receives (log it in your error handler) and fix the client/proxy producing the malformed value.","Ensure any reverse proxy forwards the Referer header verbatim without re-encoding.","Send a valid Origin header instead, which bypasses the Referer fallback path entirely."],"exampleFix":"# before — malformed referer\ncurl -H 'Referer: htt p://broken' -X POST https://app/api\n# after — valid referer matching the host\ncurl -H 'Referer: https://app.example.com/page' -X POST https://app/api","handlingStrategy":"validation","validationCode":"// Log the raw Referer in the error handler to diagnose the malformed value\ncsrf.Config{\n  ErrorHandler: func(c fiber.Ctx, err error) error {\n    if errors.Is(err, csrf.ErrRefererInvalid) {\n      log.Printf(\"malformed Referer: %q\", c.Get(fiber.HeaderReferer))\n    }\n    return c.SendStatus(403)\n  },\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure reverse proxies forward Referer verbatim without re-encoding.","Prefer sending Origin over Referer to use the cleaner validation path.","Log malformed headers to identify the corrupting intermediary."],"tags":["csrf","security","headers","url-parsing"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}