{"id":"7b9fcb19e5330ada","repo":"gofiber/fiber","slug":"csrf-origin-does-not-match-host-or-trusted-origin","errorCode":null,"errorMessage":"csrf: origin does not match host or trusted origins","messagePattern":"csrf: origin does not match host or trusted origins","errorType":"validation","errorClass":"ErrOriginNoMatch","httpStatus":null,"severity":"warning","filePath":"middleware/csrf/csrf.go","lineNumber":29,"sourceCode":"\n\t\"github.com/gofiber/utils/v2\"\n\tutilsstrings \"github.com/gofiber/utils/v2/strings\"\n\n\t\"github.com/gofiber/fiber/v3\"\n\t\"github.com/gofiber/fiber/v3/extractors\"\n\t\"github.com/gofiber/fiber/v3/internal/redact\"\n\t\"github.com/gofiber/fiber/v3/internal/schemehost\"\n\t\"github.com/gofiber/fiber/v3/middleware/logger\"\n)\n\nvar (\n\tErrTokenNotFound    = errors.New(\"csrf: token not found\")\n\tErrTokenInvalid     = errors.New(\"csrf: token invalid\")\n\tErrFetchSiteInvalid = errors.New(\"csrf: sec-fetch-site header invalid\")\n\tErrRefererNotFound  = errors.New(\"csrf: referer header missing\")\n\tErrRefererInvalid   = errors.New(\"csrf: referer header invalid\")\n\tErrRefererNoMatch   = errors.New(\"csrf: referer does not match host or trusted origins\")\n\tErrOriginInvalid    = errors.New(\"csrf: origin header invalid\")\n\tErrOriginNoMatch    = errors.New(\"csrf: origin does not match host or trusted origins\")\n\terrOriginNotFound   = errors.New(\"origin not supplied or is null\") // internal error, will not be returned to the user\n\tdummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.\n\n)\n\nvar registerLogContextTagsOnce sync.Once\n\n// Handler for CSRF middleware\ntype Handler struct {\n\tsessionManager *sessionManager\n\tstorageManager *storageManager\n\tconfig         Config\n}\n\n// The contextKey type is unexported to prevent collisions with context keys defined in\n// other packages.\ntype contextKey int","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/csrf/csrf.go#L11-L47","documentation":"Returned by csrf.originMatchesHost (csrf.go:394) when the Origin header parses successfully on an unsafe-method request but its scheme+host does not match the request's own scheme+host and is not in the TrustedOrigins allowlist. This is the primary cross-origin CSRF rejection and fires before token validation, so a mismatched origin never reaches the token check.","triggerScenarios":"An unsafe-method request (POST/PUT/PATCH/DELETE) arrives with Origin 'https://evil.com' or 'https://other.example.com' when the server host is 'api.example.com' and that origin is not in TrustedOrigins. The schemehost.Match at line 380 fails, and neither the exact trusted list (line 386) nor the subdomain wildcards (line 390) match.","commonSituations":"Frontend on a different domain/subdomain not whitelisted; scheme mismatch (http frontend vs https API); legitimate third-party integrations not added to TrustedOrigins; actual CSRF attack. Very common when separating frontend and API onto different subdomains during development.","solutions":["Add every legitimate frontend origin to Config.TrustedOrigins.","Use the subdomain wildcard 'https://*.example.com' to cover all subdomains of a domain.","Ensure scheme consistency (serve the frontend over HTTPS if the API is HTTPS).","Set Config.Next to skip CSRF on trusted internal/server-to-server routes that use a shared-secret auth instead."],"exampleFix":"// before\napp.Use(csrf.New())\n// after\napp.Use(csrf.New(csrf.Config{\n  TrustedOrigins: []string{\"https://app.example.com\", \"https://*.staging.example.com\"},\n}))","handlingStrategy":"validation","validationCode":"// Validate that all expected client origins are trusted before deploy\nfrontendOrigins := []string{\"https://app.example.com\", \"https://www.example.com\"}\nfor _, o := range frontendOrigins {\n    _, valid := url.Parse(o)\n    if valid != nil || !slices.Contains(csrfCfg.TrustedOrigins, o) {\n        log.Printf(\"WARN: frontend origin %s not trusted by CSRF\", o)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Document and review TrustedOrigins on every frontend domain change.","Use wildcard subdomains to cover staging/preview environments.","Keep frontend and API on the same scheme to avoid scheme-mismatch rejections."],"tags":["csrf","security","cors","configuration","origin"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}