gofiber/fiber · warning · ErrRefererInvalid

csrf: referer header invalid

Error message

csrf: referer header invalid

What it means

Returned by csrf.refererMatchesHost (csrf.go:408) when the Referer header is present on an HTTPS unsafe-method request (and Origin is absent) but url.Parse fails to parse it. This indicates the Referer value is syntactically malformed and cannot be interpreted as a URL, so origin matching is impossible.

Source

Thrown at middleware/csrf/csrf.go:26

	"strings"
	"sync"
	"time"

	"github.com/gofiber/utils/v2"
	utilsstrings "github.com/gofiber/utils/v2/strings"

	"github.com/gofiber/fiber/v3"
	"github.com/gofiber/fiber/v3/extractors"
	"github.com/gofiber/fiber/v3/internal/redact"
	"github.com/gofiber/fiber/v3/internal/schemehost"
	"github.com/gofiber/fiber/v3/middleware/logger"
)

var (
	ErrTokenNotFound    = errors.New("csrf: token not found")
	ErrTokenInvalid     = errors.New("csrf: token invalid")
	ErrFetchSiteInvalid = errors.New("csrf: sec-fetch-site header invalid")
	ErrRefererNotFound  = errors.New("csrf: referer header missing")
	ErrRefererInvalid   = errors.New("csrf: referer header invalid")
	ErrRefererNoMatch   = errors.New("csrf: referer does not match host or trusted origins")
	ErrOriginInvalid    = errors.New("csrf: origin header invalid")
	ErrOriginNoMatch    = errors.New("csrf: origin does not match host or trusted origins")
	errOriginNotFound   = errors.New("origin not supplied or is null") // internal error, will not be returned to the user
	dummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.

)

var registerLogContextTagsOnce sync.Once

// Handler for CSRF middleware
type Handler struct {
	sessionManager *sessionManager
	storageManager *storageManager
	config         Config
}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Inspect the raw Referer header the server receives (log it in your error handler) and fix the client/proxy producing the malformed value.
2. Ensure any reverse proxy forwards the Referer header verbatim without re-encoding.
3. Send a valid Origin header instead, which bypasses the Referer fallback path entirely.

Example fix

# before — malformed referer
curl -H 'Referer: htt p://broken' -X POST https://app/api
# after — valid referer matching the host
curl -H 'Referer: https://app.example.com/page' -X POST https://app/api

// Log the raw Referer in the error handler to diagnose the malformed value
csrf.Config{
  ErrorHandler: func(c fiber.Ctx, err error) error {
    if errors.Is(err, csrf.ErrRefererInvalid) {
      log.Printf("malformed Referer: %q", c.Get(fiber.HeaderReferer))
    }
    return c.SendStatus(403)
  },
}

When it happens

Trigger: An HTTPS state-changing request carries a Referer header that url.Parse rejects — e.g. containing invalid escape sequences, control characters, or a malformed scheme. Browsers never produce such values, so this points to a buggy client, a corrupting proxy, or a hand-crafted request.

Common situations: A reverse proxy or WAF that rewrites/corrupts the Referer header; a client library that sets Referer to a non-URL value; manual curl testing with a typo in the Referer; encoding issues in header forwarding between tiers.

Related errors

• csrf: origin header invalid
• csrf: sec-fetch-site header invalid
• csrf: referer header missing
• csrf: referer does not match host or trusted origins
• csrf: token not found

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/595658bd924d6083.json. Report an issue: GitHub.