{"id":"c9d5cfe7903ec02c","repo":"gofiber/fiber","slug":"csrf-sec-fetch-site-header-invalid","errorCode":null,"errorMessage":"csrf: sec-fetch-site header invalid","messagePattern":"csrf: sec-fetch-site header invalid","errorType":"validation","errorClass":"ErrFetchSiteInvalid","httpStatus":null,"severity":"warning","filePath":"middleware/csrf/csrf.go","lineNumber":24,"sourceCode":"\t\"net/url\"\n\t\"slices\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/gofiber/utils/v2\"\n\tutilsstrings \"github.com/gofiber/utils/v2/strings\"\n\n\t\"github.com/gofiber/fiber/v3\"\n\t\"github.com/gofiber/fiber/v3/extractors\"\n\t\"github.com/gofiber/fiber/v3/internal/redact\"\n\t\"github.com/gofiber/fiber/v3/internal/schemehost\"\n\t\"github.com/gofiber/fiber/v3/middleware/logger\"\n)\n\nvar (\n\tErrTokenNotFound    = errors.New(\"csrf: token not found\")\n\tErrTokenInvalid     = errors.New(\"csrf: token invalid\")\n\tErrFetchSiteInvalid = errors.New(\"csrf: sec-fetch-site header invalid\")\n\tErrRefererNotFound  = errors.New(\"csrf: referer header missing\")\n\tErrRefererInvalid   = errors.New(\"csrf: referer header invalid\")\n\tErrRefererNoMatch   = errors.New(\"csrf: referer does not match host or trusted origins\")\n\tErrOriginInvalid    = errors.New(\"csrf: origin header invalid\")\n\tErrOriginNoMatch    = errors.New(\"csrf: origin does not match host or trusted origins\")\n\terrOriginNotFound   = errors.New(\"origin not supplied or is null\") // internal error, will not be returned to the user\n\tdummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.\n\n)\n\nvar registerLogContextTagsOnce sync.Once\n\n// Handler for CSRF middleware\ntype Handler struct {\n\tsessionManager *sessionManager\n\tstorageManager *storageManager\n\tconfig         Config","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/csrf/csrf.go#L6-L42","documentation":"Returned by csrf.validateSecFetchSite (csrf.go:359) when the Sec-Fetch-Site request header is present but its value is not one of the four valid tokens: 'same-origin', 'none', 'cross-site', or 'same-site' (compared case-insensitively). The check runs before token validation on all unsafe HTTP methods and rejects the request early as a defense-in-depth measure against crafted fetch metadata.","triggerScenarios":"A browser or client sends a Sec-Fetch-Site header with a malformed or non-standard value on a POST/PUT/PATCH/DELETE request. Browsers send valid values automatically, so this typically indicates a broken browser extension, a modified/outdated browser, an automated tool that sets the header incorrectly, or a proxy that mangles the header.","commonSituations":"Security-testing tools (Burp, custom scripts) that inject a deliberately invalid Sec-Fetch-Site; browser extensions that rewrite request headers; non-browser clients that set the header to guess values like 'same origin' (with a space) or 'cors'.","solutions":["If the client is a browser, ensure no extension is modifying Sec-Fetch-Site; the browser sets it automatically and correctly.","If the client is an automated tool, either omit the Sec-Fetch-Site header entirely (the middleware only validates when present) or send a valid token.","Whitelist the offending client path via Config.Next if it is a known internal caller."],"exampleFix":"# before — curl sets an invalid value\ncurl -H 'Sec-Fetch-Site: same origin' -X POST https://app/api\n# after — omit the header (browser sets it) or send a valid token\ncurl -X POST https://app/api","handlingStrategy":"validation","validationCode":"// Client-side: never set Sec-Fetch-Site manually; let the browser set it\n// If scripting the header, only use valid tokens\nvalidFetchSites := map[string]bool{\"same-origin\":true,\"none\":true,\"cross-site\":true,\"same-site\":true}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not manually set Sec-Fetch-Site in client code — browsers manage it.","Audit browser extensions if this appears in production traffic.","Use Config.Next to bypass CSRF for non-browser internal clients."],"tags":["csrf","security","headers","browser"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}