{"id":"cb4261690dc15b37","repo":"gofiber/fiber","slug":"csrf-unexpected-value-type-t-in-storage","errorCode":null,"errorMessage":"csrf: unexpected value type %T in storage","messagePattern":"csrf: unexpected value type %T in storage","errorType":"http","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"middleware/csrf/storage_manager.go","lineNumber":48,"sourceCode":"\t\tstorageManager.memory = memory.New()\n\t}\n\treturn storageManager\n}\n\n// get raw data from storage or memory\nfunc (m *storageManager) getRaw(ctx context.Context, key string) ([]byte, error) {\n\tif m.storage != nil {\n\t\traw, err := m.storage.GetWithContext(ctx, key)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"csrf: failed to get value from storage: %w\", err)\n\t\t}\n\t\treturn raw, nil\n\t}\n\n\tif value := m.memory.Get(key); value != nil {\n\t\traw, ok := value.([]byte)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"csrf: unexpected value type %T in storage\", value)\n\t\t}\n\t\treturn raw, nil\n\t}\n\n\treturn nil, nil\n}\n\n// set data to storage or memory\nfunc (m *storageManager) setRaw(ctx context.Context, key string, raw []byte, exp time.Duration) error {\n\tif m.storage != nil {\n\t\tif err := m.storage.SetWithContext(ctx, key, raw, exp); err != nil {\n\t\t\treturn fmt.Errorf(\"csrf: failed to store key %q: %w\", m.logKey(key), err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tm.memory.Set(key, raw, exp)\n\treturn nil","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/csrf/storage_manager.go#L30-L66","documentation":"Thrown at middleware/csrf/storage_manager.go:48 on the in-memory fallback path: memory.Get(key) returned a non-nil value whose Go type is not []byte. The CSRF storage manager expects byte slices in its private memory.Storage; any other type means the store was contaminated by another writer under a colliding key.","triggerScenarios":"Only fires when CSRF is configured without an explicit Storage (so it allocates its own memory.Storage) AND that same store pointer is shared with another component writing non-[]byte values under colliding keys. The default newStorageManager allocates a private store, so this should never occur in normal wiring.","commonSituations":"Test harness sharing one memory.Storage across cache + CSRF middlewares; custom fork that injects a shared store; deliberate key-prefix reuse across components during development.","solutions":["Stop sharing one *memory.Storage across middlewares that store different types; let CSRF allocate its own (default when Storage is nil).","Namespace keys with distinct prefixes if sharing a store is unavoidable.","Reset memory.Storage between tests to avoid cross-test contamination.","Audit every .Set call on the shared store to ensure only []byte values land on CSRF keys."],"exampleFix":"// before (bug): shared store across CSRF and another component\nshared := memory.New()\napp.Use(csrf.New(csrf.Config{ /* injects shared via custom wiring */ }))\n\n// after: each middleware owns its private store\napp.Use(csrf.New()) // Storage nil -> private memory.Storage, no type collision","handlingStrategy":"type-guard","validationCode":"// Ensure CSRF owns its memory store; don't inject a shared one.\nif cfg.Storage == nil && cfg.Session == nil {\n    // newStorageManager(nil, ...) allocates a private *memory.Storage - safe.\n}","typeGuard":"func asCSRFBytes(v any) ([]byte, bool) {\n    b, ok := v.([]byte)\n    return b, ok\n}","tryCatchPattern":"if v := m.memory.Get(key); v != nil {\n    raw, ok := v.([]byte)\n    if !ok {\n        // programming error - log loudly, treat as no token\n        log.Printf(\"unexpected csrf value type %T\", v)\n        return nil, nil\n    }\n    return raw, nil\n}","preventionTips":["Allocate a private memory.Storage per CSRF middleware (Storage: nil).","Never share memory stores across middlewares with different value types.","Reset memory stores between tests.","Namespace keys if sharing a store is truly unavoidable."],"tags":["csrf","memory","type-safety","fiber"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}