gofiber/fiber · warning · ErrOriginInvalid

csrf: origin header invalid

Error message

csrf: origin header invalid

What it means

Returned by csrf.originMatchesHost (csrf.go:375) when the Origin header is present on an unsafe-method request but url.Parse fails to parse it. The Origin header is the primary CSRF validation mechanism for unsafe methods; a syntactically invalid Origin cannot be matched against the host or trusted origins, so the request is rejected.

Source

Thrown at middleware/csrf/csrf.go:28

	"time"

	"github.com/gofiber/utils/v2"
	utilsstrings "github.com/gofiber/utils/v2/strings"

	"github.com/gofiber/fiber/v3"
	"github.com/gofiber/fiber/v3/extractors"
	"github.com/gofiber/fiber/v3/internal/redact"
	"github.com/gofiber/fiber/v3/internal/schemehost"
	"github.com/gofiber/fiber/v3/middleware/logger"
)

var (
	ErrTokenNotFound    = errors.New("csrf: token not found")
	ErrTokenInvalid     = errors.New("csrf: token invalid")
	ErrFetchSiteInvalid = errors.New("csrf: sec-fetch-site header invalid")
	ErrRefererNotFound  = errors.New("csrf: referer header missing")
	ErrRefererInvalid   = errors.New("csrf: referer header invalid")
	ErrRefererNoMatch   = errors.New("csrf: referer does not match host or trusted origins")
	ErrOriginInvalid    = errors.New("csrf: origin header invalid")
	ErrOriginNoMatch    = errors.New("csrf: origin does not match host or trusted origins")
	errOriginNotFound   = errors.New("origin not supplied or is null") // internal error, will not be returned to the user
	dummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.

)

var registerLogContextTagsOnce sync.Once

// Handler for CSRF middleware
type Handler struct {
	sessionManager *sessionManager
	storageManager *storageManager
	config         Config
}

// The contextKey type is unexported to prevent collisions with context keys defined in
// other packages.

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Log the raw Origin header in your CSRF ErrorHandler to see the exact malformed value.
2. Fix the client or intermediary producing the invalid Origin so it sends a proper 'scheme://host' value.
3. If the client is a browser, investigate extensions or security software that rewrite headers.

Example fix

# before
curl -H 'Origin: not-a-url' -X POST https://app/api
# after
curl -H 'Origin: https://app.example.com' -X POST https://app/api

// Log the raw Origin to diagnose malformed values
csrf.Config{
  ErrorHandler: func(c fiber.Ctx, err error) error {
    if errors.Is(err, csrf.ErrOriginInvalid) {
      log.Printf("malformed Origin: %q", c.Get(fiber.HeaderOrigin))
    }
    return c.SendStatus(403)
  },
}

When it happens

Trigger: A POST/PUT/PATCH/DELETE request carries an Origin header that url.Parse rejects — malformed scheme, invalid characters, or broken encoding. Browsers always send well-formed Origin values (or 'null'), so this indicates a non-browser client, a corrupting intermediary, or a crafted attack payload.

Common situations: API testing tools that set Origin to a non-URL string; a proxy that mangles the Origin header; custom HTTP clients that guess at the header format; deliberate fuzzing/security testing.

Related errors

• csrf: referer header invalid
• csrf: sec-fetch-site header invalid
• csrf: referer header missing
• csrf: referer does not match host or trusted origins
• csrf: token not found

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/55c820003c9c22bb.json. Report an issue: GitHub.