gofiber/fiber · error

csrf: failed to store token in storage: %w

Error message

csrf: failed to store token in storage: %w

What it means

Thrown at middleware/csrf/csrf.go:283 by createOrExtendTokenInStorage() when storageManager.setRaw fails while writing (or refreshing) the CSRF token. Every safe-method request and every validated unsafe request writes/extends a token, so a Storage SET failure surfaces here.

Source

Thrown at middleware/csrf/csrf.go:283

func getRawFromStorage(c fiber.Ctx, token string, cfg *Config, sessionManager *sessionManager, storageManager *storageManager) ([]byte, error) {
	if cfg.Session != nil {
		return sessionManager.getRaw(c, token, dummyValue), nil
	}
	raw, err := storageManager.getRaw(c, token)
	if err != nil {
		return nil, fmt.Errorf("csrf: failed to fetch token from storage: %w", err)
	}
	return raw, nil
}

// createOrExtendTokenInStorage creates or extends the token in the storage
func createOrExtendTokenInStorage(c fiber.Ctx, token string, cfg *Config, sessionManager *sessionManager, storageManager *storageManager) error {
	if cfg.Session != nil {
		sessionManager.setRaw(c, token, dummyValue, cfg.IdleTimeout)
		return nil
	}
	if err := storageManager.setRaw(c, token, dummyValue, cfg.IdleTimeout); err != nil {
		return fmt.Errorf("csrf: failed to store token in storage: %w", err)
	}
	return nil
}

func deleteTokenFromStorage(c fiber.Ctx, token string, cfg *Config, sessionManager *sessionManager, storageManager *storageManager) error {
	if cfg.Session != nil {
		sessionManager.delRaw(c)
		return nil
	}
	if err := storageManager.delRaw(c, token); err != nil {
		return fmt.Errorf("csrf: failed to delete token from storage: %w", err)
	}
	return nil
}

// Update CSRF cookie
// if expireCookie is true, the cookie will expire immediately
func updateCSRFCookie(c fiber.Ctx, cfg *Config, token string) {

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Identify and resolve the backend write refusal from the wrapped driver error.
2. Ensure the storage backend has enough capacity for the IdleTimeout-bounded token set.
3. Set the storage write timeout below the request deadline so SETs complete before ctx cancellation.
4. Configure cfg.ErrorHandler to return 503 with retry semantics so the client retries cleanly.
5. If writes routinely fail, consider cfg.Session to piggyback on the session store's write path with its own retry/resilience.

Example fix

// before
app.Use(csrf.New(csrf.Config{ Storage: redis.New() }))

// after: explicit IdleTimeout + tolerant error handler
app.Use(csrf.New(csrf.Config{
    Storage:     redis.New(),
    IdleTimeout: 30 * time.Minute,
    ErrorHandler: func(c fiber.Ctx, err error) error {
        if strings.Contains(err.Error(), "failed to store token") {
            return c.Status(fiber.StatusServiceUnavailable).
                SendString("token store unavailable; please retry")
        }
        return c.Status(fiber.StatusForbidden).SendString(err.Error())
    },
}))

// At boot, validate the CSRF store accepts writes.
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
defer cancel()
if err := store.SetWithContext(ctx, "__csrf_probe__", []byte("+"), time.Minute); err != nil {
    log.Fatalf("csrf storage write probe failed: %v", err)
}

cfg.ErrorHandler = func(c fiber.Ctx, err error) error {
    if strings.Contains(err.Error(), "failed to store token") {
        c.Set(fiber.HeaderRetryAfter, "5")
        return c.Status(fiber.StatusServiceUnavailable).
            SendString("token store busy; retry shortly")
    }
    return c.Status(fiber.StatusForbidden).SendString(err.Error())
}

When it happens

Trigger: The CSRF middleware generates a fresh token (or extends an existing one) and calls storageManager.setRaw -> Storage.SetWithContext, which fails: backend OOM, connection lost, ctx cancelled, disk full.

Common situations: Redis maxmemory-policy returning errors under load; persistent backend out of disk; storage AUTH expired; client disconnect mid-request causing ctx cancellation during SET.

Related errors

• csrf: failed to fetch token from storage: %w
• csrf: failed to delete token from storage: %w
• csrf: failed to get value from storage: %w
• csrf: failed to store key %q: %w
• csrf: failed to delete key %q: %w

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/61bc419d8118f4e0.json. Report an issue: GitHub.