gofiber/fiber · warning · ErrFetchSiteInvalid

csrf: sec-fetch-site header invalid

Error message

csrf: sec-fetch-site header invalid

What it means

Returned by csrf.validateSecFetchSite (csrf.go:359) when the Sec-Fetch-Site request header is present but its value is not one of the four valid tokens: 'same-origin', 'none', 'cross-site', or 'same-site' (compared case-insensitively). The check runs before token validation on all unsafe HTTP methods and rejects the request early as a defense-in-depth measure against crafted fetch metadata.

Source

Thrown at middleware/csrf/csrf.go:24

	"net/url"
	"slices"
	"strings"
	"sync"
	"time"

	"github.com/gofiber/utils/v2"
	utilsstrings "github.com/gofiber/utils/v2/strings"

	"github.com/gofiber/fiber/v3"
	"github.com/gofiber/fiber/v3/extractors"
	"github.com/gofiber/fiber/v3/internal/redact"
	"github.com/gofiber/fiber/v3/internal/schemehost"
	"github.com/gofiber/fiber/v3/middleware/logger"
)

var (
	ErrTokenNotFound    = errors.New("csrf: token not found")
	ErrTokenInvalid     = errors.New("csrf: token invalid")
	ErrFetchSiteInvalid = errors.New("csrf: sec-fetch-site header invalid")
	ErrRefererNotFound  = errors.New("csrf: referer header missing")
	ErrRefererInvalid   = errors.New("csrf: referer header invalid")
	ErrRefererNoMatch   = errors.New("csrf: referer does not match host or trusted origins")
	ErrOriginInvalid    = errors.New("csrf: origin header invalid")
	ErrOriginNoMatch    = errors.New("csrf: origin does not match host or trusted origins")
	errOriginNotFound   = errors.New("origin not supplied or is null") // internal error, will not be returned to the user
	dummyValue          = []byte{'+'}                                  // dummyValue is a placeholder value stored in token storage. The actual token validation relies on the key, not this value.

)

var registerLogContextTagsOnce sync.Once

// Handler for CSRF middleware
type Handler struct {
	sessionManager *sessionManager
	storageManager *storageManager
	config         Config

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. If the client is a browser, ensure no extension is modifying Sec-Fetch-Site; the browser sets it automatically and correctly.
2. If the client is an automated tool, either omit the Sec-Fetch-Site header entirely (the middleware only validates when present) or send a valid token.
3. Whitelist the offending client path via Config.Next if it is a known internal caller.

Example fix

# before — curl sets an invalid value
curl -H 'Sec-Fetch-Site: same origin' -X POST https://app/api
# after — omit the header (browser sets it) or send a valid token
curl -X POST https://app/api

// Client-side: never set Sec-Fetch-Site manually; let the browser set it
// If scripting the header, only use valid tokens
validFetchSites := map[string]bool{"same-origin":true,"none":true,"cross-site":true,"same-site":true}

When it happens

Trigger: A browser or client sends a Sec-Fetch-Site header with a malformed or non-standard value on a POST/PUT/PATCH/DELETE request. Browsers send valid values automatically, so this typically indicates a broken browser extension, a modified/outdated browser, an automated tool that sets the header incorrectly, or a proxy that mangles the header.

Common situations: Security-testing tools (Burp, custom scripts) that inject a deliberately invalid Sec-Fetch-Site; browser extensions that rewrite request headers; non-browser clients that set the header to guess values like 'same origin' (with a space) or 'cors'.

Related errors

• csrf: referer header missing
• csrf: referer header invalid
• csrf: referer does not match host or trusted origins
• csrf: origin header invalid
• csrf: token not found

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/c9d5cfe7903ec02c.json. Report an issue: GitHub.