{"id":"f2c5cfdc07c5d9db","repo":"gofiber/fiber","slug":"csrf-invalid-origin-format-in-configuration-ma","errorCode":null,"errorMessage":"[CSRF] Invalid origin format in configuration:${maskedOrigin}","messagePattern":"\\[CSRF\\] Invalid origin format in configuration:(.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/csrf/csrf.go","lineNumber":90,"sourceCode":"\tvar sessionManager *sessionManager\n\tvar storageManager *storageManager\n\tif cfg.Session != nil {\n\t\tsessionManager = newSessionManager(cfg.Session)\n\t} else {\n\t\tstorageManager = newStorageManager(cfg.Storage, redactKeys)\n\t}\n\n\t// Pre-parse trusted origins\n\ttrustedOrigins := []string{}\n\ttrustedSubOrigins := []subdomain{}\n\n\tfor _, origin := range cfg.TrustedOrigins {\n\t\ttrimmedOrigin := utils.TrimSpace(origin)\n\t\tif i := strings.Index(trimmedOrigin, \"://*.\"); i != -1 {\n\t\t\twithoutWildcard := trimmedOrigin[:i+len(\"://\")] + trimmedOrigin[i+len(\"://*.\"):]\n\t\t\tisValid, normalizedOrigin := normalizeOrigin(withoutWildcard)\n\t\t\tif !isValid {\n\t\t\t\tpanic(\"[CSRF] Invalid origin format in configuration:\" + maskValue(origin))\n\t\t\t}\n\t\t\tschemeSep := strings.Index(normalizedOrigin, \"://\") + len(\"://\")\n\t\t\tsd := subdomain{prefix: normalizedOrigin[:schemeSep], suffix: normalizedOrigin[schemeSep:]}\n\t\t\ttrustedSubOrigins = append(trustedSubOrigins, sd)\n\t\t} else {\n\t\t\tisValid, normalizedOrigin := normalizeOrigin(trimmedOrigin)\n\t\t\tif !isValid {\n\t\t\t\tpanic(\"[CSRF] Invalid origin format in configuration:\" + maskValue(origin))\n\t\t\t}\n\t\t\ttrustedOrigins = append(trustedOrigins, normalizedOrigin)\n\t\t}\n\t}\n\n\t// Create the handler outside of the returned function\n\thandler := &Handler{\n\t\tconfig:         cfg,\n\t\tsessionManager: sessionManager,\n\t\tstorageManager: storageManager,","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/csrf/csrf.go#L72-L108","documentation":"CSRF trusted-origin validation (csrf.go:84-94) mirrors CORS: entries containing \"://*.\" are stripped of the wildcard and passed to normalizeOrigin. A failure (unparseable URL, empty host, embedded '*', userinfo, path, query, fragment) panics at startup so a broken TrustedOrigins list cannot silently accept or reject the wrong origins.","triggerScenarios":"Setting TrustedOrigins to a malformed wildcard such as \"https://*\" (no suffix), \"https://*.example.com/admin\" (path), or an entry lacking a scheme after wildcard removal.","commonSituations":"Adding TrustedOrigins to support a SPA on a different domain and using path-scoped values, or pulling the list from an env var that resolves to a placeholder/empty string.","solutions":["Use the bare wildcard form: TrustedOrigins: []string{\"https://*.example.com\"}.","Ensure each entry has scheme + non-empty host and no path/query/fragment.","Validate env-derived origin lists with a unit test before passing them to csrf.New."],"exampleFix":"// before\ncsrf.New(csrf.Config{TrustedOrigins: []string{\"https://*.example.com/login\"}})\n\n// after\ncsrf.New(csrf.Config{TrustedOrigins: []string{\"https://*.example.com\"}})","handlingStrategy":"validation","validationCode":"func validateCSRFTrustedWildcardOrigins(origins []string) error {\n    for _, o := range origins {\n        i := strings.Index(o, \"://*.\")\n        if i == -1 { continue }\n        base := o[:i+len(\"://\")] + o[i+len(\"://*.\"):]\n        u, err := url.Parse(base)\n        if err != nil || u.Host == \"\" || strings.Contains(u.Host, \"*\") ||\n            (u.Path != \"\" && u.Path != \"/\") {\n            return fmt.Errorf(\"invalid CSRF wildcard origin %q\", o)\n        }\n    }\n    return nil\n}\n\nif err := validateCSRFTrustedWildcardOrigins(cfg.TrustedOrigins); err != nil { log.Fatal(err) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep wildcard trusted origins in the exact \"scheme://*.host\" form.","Validate env-derived TrustedOrigins with a unit test before csrf.New."],"tags":["csrf","security","origin","trusted-origins","wildcard","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}