{"id":"752303f73a6ed116","repo":"gofiber/fiber","slug":"csrf-referer-header-missing","errorCode":null,"errorMessage":"csrf: referer header missing","messagePattern":"csrf: referer header missing","errorType":"validation","errorClass":"ErrRefererNotFound","httpStatus":null,"severity":"warning","filePath":"middleware/csrf/csrf.go","lineNumber":25,"sourceCode":"\t\"slices\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/gofiber/utils/v2\"\n\tutilsstrings \"github.com/gofiber/utils/v2/strings\"\n\n\t\"github.com/gofiber/fiber/v3\"\n\t\"github.com/gofiber/fiber/v3/extractors\"\n\t\"github.com/gofiber/fiber/v3/internal/redact\"\n\t\"github.com/gofiber/fiber/v3/internal/schemehost\"\n\t\"github.com/gofiber/fiber/v3/middleware/logger\"\n)\n\nvar (\n\tErrTokenNotFound    = errors.New(\"csrf: token not found\")\n\tErrTokenInvalid     = errors.New(\"csrf: token invalid\")\n\tErrFetchSiteInvalid = errors.New(\"csrf: sec-fetch-site header invalid\")\n\tErrRefererNotFound  = errors.New(\"csrf: referer header missing\")\n\tErrRefererInvalid   = errors.New(\"csrf: referer header invalid\")\n\tErrRefererNoMatch   = errors.New(\"csrf: referer does not match host or trusted origins\")\n\tErrOriginInvalid    = errors.New(\"csrf: origin header invalid\")\n\tErrOriginNoMatch    = errors.New(\"csrf: origin does not match host or trusted origins\")\n\terrOriginNotFound   = errors.New(\"origin not supplied or is null\") // internal error, will not be returned to the user\n\tdummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.\n\n)\n\nvar registerLogContextTagsOnce sync.Once\n\n// Handler for CSRF middleware\ntype Handler struct {\n\tsessionManager *sessionManager\n\tstorageManager *storageManager\n\tconfig         Config\n}","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/csrf/csrf.go#L7-L43","documentation":"Returned by csrf.refererMatchesHost (csrf.go:403) when, on an HTTPS unsafe-method request with no Origin header, the Referer header is also absent. The CSRF middleware falls back to Referer validation only for HTTPS connections when Origin is missing (csrf.go:150-156). A state-changing HTTPS request with neither Origin nor Referer cannot be verified as same-site, so it is rejected.","triggerScenarios":"An HTTPS POST/PUT/PATCH/DELETE request that carries no Origin header AND no Referer header. This is abnormal for browsers (they always send Referer on same-origin navigations/fetches unless a Referrer-Policy strips it), so it usually indicates a non-browser client, an over-aggressive Referrer-Policy: no-referrer, or a stripped header.","commonSituations":"Server-to-server API calls over HTTPS with no browser headers; a strict Referrer-Policy: no-referrer on the page making the request; a privacy proxy or browser setting that strips Referer; API testing tools that don't set Referer.","solutions":["Have the client send an Origin header (preferred) or a valid Referer header matching the host.","Relax the page's Referrer-Policy from 'no-referrer' to 'same-origin' or 'strict-origin'.","Add the calling origin to Config.TrustedOrigins if it is a legitimate cross-origin caller that sets Origin.","Use Config.Next to skip CSRF for trusted server-to-server API routes."],"exampleFix":"// before — server-to-server call with no headers\nhttp.Post(url, body)\n// after — send Origin header\nreq, _ := http.NewRequest(\"POST\", url, body)\nreq.Header.Set(\"Origin\", \"https://trusted.internal\")\nhttp.DefaultClient.Do(req)","handlingStrategy":"validation","validationCode":"// Client: ensure Origin or Referer is present on HTTPS unsafe requests\nreq.Header.Set(\"Origin\", \"https://\"+host) // always set Origin for server-to-server","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set the Origin header on all server-to-server unsafe requests to HTTPS APIs.","Avoid Referrer-Policy: no-referrer on pages that make CSRF-protected requests.","Add legitimate origins to TrustedOrigins for cross-origin callers."],"tags":["csrf","security","headers","https"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}