gofiber/fiber · warning · ErrRefererNoMatch

csrf: referer does not match host or trusted origins

Error message

csrf: referer does not match host or trusted origins

What it means

Returned by csrf.refererMatchesHost (csrf.go:430) when the Referer header parses successfully on an HTTPS unsafe-method request (Origin absent) but its scheme+host does not match the request's own scheme+host and is not in the TrustedOrigins allowlist (including subdomain wildcards). This is the core CSRF rejection for cross-site referers on HTTPS.

Source

Thrown at middleware/csrf/csrf.go:27

	"sync"
	"time"

	"github.com/gofiber/utils/v2"
	utilsstrings "github.com/gofiber/utils/v2/strings"

	"github.com/gofiber/fiber/v3"
	"github.com/gofiber/fiber/v3/extractors"
	"github.com/gofiber/fiber/v3/internal/redact"
	"github.com/gofiber/fiber/v3/internal/schemehost"
	"github.com/gofiber/fiber/v3/middleware/logger"
)

var (
	ErrTokenNotFound    = errors.New("csrf: token not found")
	ErrTokenInvalid     = errors.New("csrf: token invalid")
	ErrFetchSiteInvalid = errors.New("csrf: sec-fetch-site header invalid")
	ErrRefererNotFound  = errors.New("csrf: referer header missing")
	ErrRefererInvalid   = errors.New("csrf: referer header invalid")
	ErrRefererNoMatch   = errors.New("csrf: referer does not match host or trusted origins")
	ErrOriginInvalid    = errors.New("csrf: origin header invalid")
	ErrOriginNoMatch    = errors.New("csrf: origin does not match host or trusted origins")
	errOriginNotFound   = errors.New("origin not supplied or is null") // internal error, will not be returned to the user
	dummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.

)

var registerLogContextTagsOnce sync.Once

// Handler for CSRF middleware
type Handler struct {
	sessionManager *sessionManager
	storageManager *storageManager
	config         Config
}

// The contextKey type is unexported to prevent collisions with context keys defined in

View on GitHub (pinned to 9a4c7e57fe)

Solutions

Add the legitimate cross-origin caller to Config.TrustedOrigins (e.g. 'https://app.example.com').
For subdomains, use the wildcard form 'https://*.example.com' in TrustedOrigins.
Ensure the frontend and backend share the same scheme and host, or proxy through the same origin.
If the caller can set Origin instead of Referer, add that origin to TrustedOrigins for a cleaner check.

Example fix

// before
app.Use(csrf.New()) // no trusted origins
// after — allow the known frontend origin
app.Use(csrf.New(csrf.Config{
  TrustedOrigins: []string{"https://app.example.com", "https://*.example.com"},
}))

Defensive patterns

Strategy: validation

Validate before calling

// At startup, verify all frontend origins are listed in TrustedOrigins
requiredOrigins := []string{"https://app.example.com"}
for _, o := range requiredOrigins {
    if !slices.Contains(csrfCfg.TrustedOrigins, o) {
        log.Fatalf("origin %s not in CSRF TrustedOrigins", o)
    }
}

Prevention

Maintain TrustedOrigins as a checked-in config reviewed on every domain change.
Use wildcard subdomain patterns to reduce omission errors.
Ensure scheme consistency between frontend and API.

When it happens

Trigger: An HTTPS POST/PUT/etc. arrives with a Referer whose origin differs from the server's host and is not a configured TrustedOrigin. Example: server at api.example.com receives a POST with Referer https://evil.com/form. The schemehost.Match check (line 414) fails and no trusted-origin fallback matches.

Common situations: Legitimate cross-origin form submissions or embeds not added to TrustedOrigins; a subdomain (app.example.com) calling api.example.com without listing it; scheme mismatch (http referer to https server); an actual CSRF attack attempt.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/864a0c78907e0fe6.json. Report an issue: GitHub.