gofiber/fiber · warning

csrf: failed to delete key

Error message

csrf: failed to delete key %q: %w

What it means

Returned by storageManager.delRaw when the external Storage's DeleteWithContext fails while removing a CSRF token. This is the storage-driver-level failure that bubbles up as error 153 during token invalidation.

Solutions

1. Inspect the wrapped error for permission/connectivity/cancellation.
2. Ensure Storage credentials grant DEL permission.
3. Keep IdleTimeout short so a failed delete self-heals via TTL.
4. Log and continue — do not block logout on a best-effort token delete.

Example fix

// before
if err := m.storage.DeleteWithContext(ctx, key); err != nil {
    return fmt.Errorf("csrf: failed to delete key %q: %w", m.logKey(key), err)
}

// after: best-effort, TTL backstops
if err := m.storage.DeleteWithContext(ctx, key); err != nil {
    log.Warn("csrf token delete failed; TTL will expire it:", err)
}
return nil

func validateCsrfDel(ctx context.Context, s fiber.Storage) error {
    _ = s.SetWithContext(ctx, "__csrf_d__", []byte("x"), time.Second)
    return s.DeleteWithContext(ctx, "__csrf_d__")
}

if err := m.storage.DeleteWithContext(ctx, key); err != nil {
    log.Warn("csrf token delete failed; TTL will expire it:", err)
}
return nil

When it happens

Trigger: CSRF token deletion against cfg.Storage where Storage.DeleteWithContext errors: backend down, ACL missing DEL, network error, context cancellation, failover mid-delete.

Common situations: Redis ACL without DEL permission, storage transient outage during logout, connection errors, custom Storage impl returning errors on Delete.

Related errors

• csrf: failed to delete token from storage
• csrf: failed to get value from storage
• csrf: failed to store key
• cache: failed to delete key
• csrf: failed to fetch token from storage

AI-assisted analysis of gofiber/fiber@a105acad6c (2026-08-11). Data as JSON: /api/errors/dfe2e8c0248d74cc. Report an issue: GitHub.

Appendix: source

Thrown at middleware/csrf/storage_manager.go:73

// set data to storage or memory
func (m *storageManager) setRaw(ctx context.Context, key string, raw []byte, exp time.Duration) error {
	if m.storage != nil {
		if err := m.storage.SetWithContext(ctx, key, raw, exp); err != nil {
			return fmt.Errorf("csrf: failed to store key %q: %w", m.logKey(key), err)
		}
		return nil
	}

	m.memory.Set(key, raw, exp)
	return nil
}

// delete data from storage or memory
func (m *storageManager) delRaw(ctx context.Context, key string) error {
	if m.storage != nil {
		if err := m.storage.DeleteWithContext(ctx, key); err != nil {
			return fmt.Errorf("csrf: failed to delete key %q: %w", m.logKey(key), err)
		}
		return nil
	}

	m.memory.Delete(key)
	return nil
}

func (m *storageManager) logKey(key string) string {
	if m.shouldRedactKeys {
		return redactedKey
	}
	return key
}

View on GitHub (pinned to a105acad6c)