tailscale/tailscale · error

CSRF request denied with invalid Origin %q

Error message

CSRF request denied with invalid Origin %q

What it means

Sent as a 403 by the web client's CSRF middleware when the request's Origin header cannot be parsed as a URL. The request is rejected before reaching the API handler.

Source

Thrown at client/web/web.go:282

		// use the Host header to determine the expected origin
		// (use the override if set to allow for reverse proxying)
		host := r.Host
		if host == "" {
			http.Error(w, "CSRF request denied with no Host header", http.StatusForbidden)
			return
		}
		if s.originOverride != "" {
			host = s.originOverride
		}

		originHeader := r.Header.Get("Origin")
		if originHeader == "" {
			http.Error(w, "CSRF request denied with no Origin header", http.StatusForbidden)
			return
		}
		parsedOrigin, err := url.Parse(originHeader)
		if err != nil {
			http.Error(w, fmt.Sprintf("CSRF request denied with invalid Origin %q", r.Header.Get("Origin")), http.StatusForbidden)
			return
		}
		origin := parsedOrigin.Host
		if origin == "" {
			http.Error(w, "CSRF request denied with no host in the Origin header", http.StatusForbidden)
			return
		}

		if origin != host {
			http.Error(w, fmt.Sprintf("CSRF request denied with mismatched Origin %q and Host %q", origin, host), http.StatusForbidden)
			return
		}

		h.ServeHTTP(w, r)

	})
}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Inspect the raw Origin header for corruption or encoding errors
2. Fix the client/proxy generating the malformed Origin
3. Reject at the proxy layer before reaching the web client

When it happens

Trigger: Thrown at client/web/web.go:282 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/709ca301627431b1. Report an issue: GitHub.