gofiber/fiber · warning · ErrRefererNotFound

csrf: referer header missing

Error message

csrf: referer header missing

What it means

Returned by csrf.refererMatchesHost (csrf.go:403) when, on an HTTPS unsafe-method request with no Origin header, the Referer header is also absent. The CSRF middleware falls back to Referer validation only for HTTPS connections when Origin is missing (csrf.go:150-156). A state-changing HTTPS request with neither Origin nor Referer cannot be verified as same-site, so it is rejected.

Source

Thrown at middleware/csrf/csrf.go:25

	"slices"
	"strings"
	"sync"
	"time"

	"github.com/gofiber/utils/v2"
	utilsstrings "github.com/gofiber/utils/v2/strings"

	"github.com/gofiber/fiber/v3"
	"github.com/gofiber/fiber/v3/extractors"
	"github.com/gofiber/fiber/v3/internal/redact"
	"github.com/gofiber/fiber/v3/internal/schemehost"
	"github.com/gofiber/fiber/v3/middleware/logger"
)

var (
	ErrTokenNotFound    = errors.New("csrf: token not found")
	ErrTokenInvalid     = errors.New("csrf: token invalid")
	ErrFetchSiteInvalid = errors.New("csrf: sec-fetch-site header invalid")
	ErrRefererNotFound  = errors.New("csrf: referer header missing")
	ErrRefererInvalid   = errors.New("csrf: referer header invalid")
	ErrRefererNoMatch   = errors.New("csrf: referer does not match host or trusted origins")
	ErrOriginInvalid    = errors.New("csrf: origin header invalid")
	ErrOriginNoMatch    = errors.New("csrf: origin does not match host or trusted origins")
	errOriginNotFound   = errors.New("origin not supplied or is null") // internal error, will not be returned to the user
	dummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.

)

var registerLogContextTagsOnce sync.Once

// Handler for CSRF middleware
type Handler struct {
	sessionManager *sessionManager
	storageManager *storageManager
	config         Config
}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Have the client send an Origin header (preferred) or a valid Referer header matching the host.
2. Relax the page's Referrer-Policy from 'no-referrer' to 'same-origin' or 'strict-origin'.
3. Add the calling origin to Config.TrustedOrigins if it is a legitimate cross-origin caller that sets Origin.
4. Use Config.Next to skip CSRF for trusted server-to-server API routes.

Example fix

// before — server-to-server call with no headers
http.Post(url, body)
// after — send Origin header
req, _ := http.NewRequest("POST", url, body)
req.Header.Set("Origin", "https://trusted.internal")
http.DefaultClient.Do(req)

// Client: ensure Origin or Referer is present on HTTPS unsafe requests
req.Header.Set("Origin", "https://"+host) // always set Origin for server-to-server

When it happens

Trigger: An HTTPS POST/PUT/PATCH/DELETE request that carries no Origin header AND no Referer header. This is abnormal for browsers (they always send Referer on same-origin navigations/fetches unless a Referrer-Policy strips it), so it usually indicates a non-browser client, an over-aggressive Referrer-Policy: no-referrer, or a stripped header.

Common situations: Server-to-server API calls over HTTPS with no browser headers; a strict Referrer-Policy: no-referrer on the page making the request; a privacy proxy or browser setting that strips Referer; API testing tools that don't set Referer.

Related errors

• csrf: sec-fetch-site header invalid
• csrf: referer header invalid
• csrf: referer does not match host or trusted origins
• csrf: origin header invalid
• tls: AutoCertManager cannot be combined with CertFile/CertKe

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/752303f73a6ed116.json. Report an issue: GitHub.