tailscale/tailscale · error

CSRF request denied with mismatched Origin %q and Host %q

Error message

CSRF request denied with mismatched Origin %q and Host %q

What it means

Returned as HTTP 403 by the CSRF middleware when the Origin host differs from the request Host (or the configured origin override). This is the actual cross-site detection; reverse proxies without the override set commonly trigger it.

Source

Thrown at client/web/web.go:292

		originHeader := r.Header.Get("Origin")
		if originHeader == "" {
			http.Error(w, "CSRF request denied with no Origin header", http.StatusForbidden)
			return
		}
		parsedOrigin, err := url.Parse(originHeader)
		if err != nil {
			http.Error(w, fmt.Sprintf("CSRF request denied with invalid Origin %q", r.Header.Get("Origin")), http.StatusForbidden)
			return
		}
		origin := parsedOrigin.Host
		if origin == "" {
			http.Error(w, "CSRF request denied with no host in the Origin header", http.StatusForbidden)
			return
		}

		if origin != host {
			http.Error(w, fmt.Sprintf("CSRF request denied with mismatched Origin %q and Host %q", origin, host), http.StatusForbidden)
			return
		}

		h.ServeHTTP(w, r)

	})
}

func (s *Server) modeAPIHandler(mode ServerMode) (http.Handler, string) {
	switch mode {
	case LoginServerMode:
		return http.HandlerFunc(s.serveLoginAPI), "web_login_client_initialization"
	case ReadOnlyServerMode:
		return http.HandlerFunc(s.serveLoginAPI), "web_readonly_client_initialization"
	case ManageServerMode:
		return http.HandlerFunc(s.serveAPI), "web_client_initialization"
	default: // invalid mode
		log.Fatalf("invalid mode: %v", mode)

View on GitHub (pinned to 6e0912f979)

Solutions

1. Access the web client via the same host as served (or the Tailscale IP)
2. Configure originOverride when reverse-proxying under a different hostname
3. Fix proxy header rewriting so Origin and Host agree

When it happens

Trigger: Thrown at client/web/web.go:292 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/090cb8c06f5ea367. Report an issue: GitHub.