{"id":"864a0c78907e0fe6","repo":"gofiber/fiber","slug":"csrf-referer-does-not-match-host-or-trusted-origi","errorCode":null,"errorMessage":"csrf: referer does not match host or trusted origins","messagePattern":"csrf: referer does not match host or trusted origins","errorType":"validation","errorClass":"ErrRefererNoMatch","httpStatus":null,"severity":"warning","filePath":"middleware/csrf/csrf.go","lineNumber":27,"sourceCode":"\t\"sync\"\n\t\"time\"\n\n\t\"github.com/gofiber/utils/v2\"\n\tutilsstrings \"github.com/gofiber/utils/v2/strings\"\n\n\t\"github.com/gofiber/fiber/v3\"\n\t\"github.com/gofiber/fiber/v3/extractors\"\n\t\"github.com/gofiber/fiber/v3/internal/redact\"\n\t\"github.com/gofiber/fiber/v3/internal/schemehost\"\n\t\"github.com/gofiber/fiber/v3/middleware/logger\"\n)\n\nvar (\n\tErrTokenNotFound    = errors.New(\"csrf: token not found\")\n\tErrTokenInvalid     = errors.New(\"csrf: token invalid\")\n\tErrFetchSiteInvalid = errors.New(\"csrf: sec-fetch-site header invalid\")\n\tErrRefererNotFound  = errors.New(\"csrf: referer header missing\")\n\tErrRefererInvalid   = errors.New(\"csrf: referer header invalid\")\n\tErrRefererNoMatch   = errors.New(\"csrf: referer does not match host or trusted origins\")\n\tErrOriginInvalid    = errors.New(\"csrf: origin header invalid\")\n\tErrOriginNoMatch    = errors.New(\"csrf: origin does not match host or trusted origins\")\n\terrOriginNotFound   = errors.New(\"origin not supplied or is null\") // internal error, will not be returned to the user\n\tdummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.\n\n)\n\nvar registerLogContextTagsOnce sync.Once\n\n// Handler for CSRF middleware\ntype Handler struct {\n\tsessionManager *sessionManager\n\tstorageManager *storageManager\n\tconfig         Config\n}\n\n// The contextKey type is unexported to prevent collisions with context keys defined in","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/csrf/csrf.go#L9-L45","documentation":"Returned by csrf.refererMatchesHost (csrf.go:430) when the Referer header parses successfully on an HTTPS unsafe-method request (Origin absent) but its scheme+host does not match the request's own scheme+host and is not in the TrustedOrigins allowlist (including subdomain wildcards). This is the core CSRF rejection for cross-site referers on HTTPS.","triggerScenarios":"An HTTPS POST/PUT/etc. arrives with a Referer whose origin differs from the server's host and is not a configured TrustedOrigin. Example: server at api.example.com receives a POST with Referer https://evil.com/form. The schemehost.Match check (line 414) fails and no trusted-origin fallback matches.","commonSituations":"Legitimate cross-origin form submissions or embeds not added to TrustedOrigins; a subdomain (app.example.com) calling api.example.com without listing it; scheme mismatch (http referer to https server); an actual CSRF attack attempt.","solutions":["Add the legitimate cross-origin caller to Config.TrustedOrigins (e.g. 'https://app.example.com').","For subdomains, use the wildcard form 'https://*.example.com' in TrustedOrigins.","Ensure the frontend and backend share the same scheme and host, or proxy through the same origin.","If the caller can set Origin instead of Referer, add that origin to TrustedOrigins for a cleaner check."],"exampleFix":"// before\napp.Use(csrf.New()) // no trusted origins\n// after — allow the known frontend origin\napp.Use(csrf.New(csrf.Config{\n  TrustedOrigins: []string{\"https://app.example.com\", \"https://*.example.com\"},\n}))","handlingStrategy":"validation","validationCode":"// At startup, verify all frontend origins are listed in TrustedOrigins\nrequiredOrigins := []string{\"https://app.example.com\"}\nfor _, o := range requiredOrigins {\n    if !slices.Contains(csrfCfg.TrustedOrigins, o) {\n        log.Fatalf(\"origin %s not in CSRF TrustedOrigins\", o)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Maintain TrustedOrigins as a checked-in config reviewed on every domain change.","Use wildcard subdomain patterns to reduce omission errors.","Ensure scheme consistency between frontend and API."],"tags":["csrf","security","headers","cors","configuration"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}