Skip to content

🐛 fix(csrf): strip path from referer before matching trusted origins #4204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ReneWerner87 merged 4 commits into from
Apr 11, 2026
Merged

🐛 fix(csrf): strip path from referer before matching trusted origins #4204

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dc31002
fix(csrf): strip path from referer before matching trusted origins
aviu16 Apr 10, 2026
ba32016
drop redundant ToLower and add wildcard subdomain path test
aviu16 Apr 10, 2026
4d6aa5a
Merge branch 'main' into fix/csrf-referer-origin-matching
sixcolors Apr 10, 2026
a274da0
Merge branch 'main' into fix/csrf-referer-origin-matching
ReneWerner87 Apr 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions middleware/csrf/csrf.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,14 +387,14 @@ func refererMatchesHost(c fiber.Ctx, trustedOrigins []string, trustedSubOrigins
return nil
}

referer = refererURL.String()
refererOrigin := refererURL.Scheme + "://" + refererURL.Host

if slices.Contains(trustedOrigins, referer) {
if slices.Contains(trustedOrigins, refererOrigin) {
return nil
}

for _, trustedSubOrigin := range trustedSubOrigins {
if trustedSubOrigin.match(referer) {
if trustedSubOrigin.match(refererOrigin) {
return nil
}
}
Expand Down
32 changes: 32 additions & 0 deletions middleware/csrf/csrf_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1336,6 +1336,38 @@ func Test_CSRF_TrustedOrigins(t *testing.T) {
ctx.Request.Header.SetCookie(ConfigDefault.CookieName, token)
h(ctx)
require.Equal(t, 403, ctx.Response.StatusCode())

// Test Trusted Referer with path — referer URL includes a path component
// which must not prevent matching against the trusted origin
ctx.Request.Reset()
ctx.Response.Reset()
ctx.Request.Header.SetMethod(fiber.MethodPost)
ctx.Request.Header.Set(fiber.HeaderXForwardedProto, "https")
ctx.Request.URI().SetScheme("https")
ctx.Request.URI().SetHost("example.com")
ctx.Request.Header.SetProtocol("https")
ctx.Request.Header.SetHost("example.com")
ctx.Request.Header.Set(fiber.HeaderReferer, "https://safe.example.com/some/path?q=1")
ctx.Request.Header.Set(HeaderName, token)
ctx.Request.Header.SetCookie(ConfigDefault.CookieName, token)
h(ctx)
require.Equal(t, 200, ctx.Response.StatusCode())

// Test Trusted Referer Wildcard with path — wildcard subdomain referer
// that includes a path must still match the trusted sub-origin
ctx.Request.Reset()
ctx.Response.Reset()
ctx.Request.Header.SetMethod(fiber.MethodPost)
ctx.Request.Header.Set(fiber.HeaderXForwardedProto, "https")
ctx.Request.URI().SetScheme("https")
ctx.Request.URI().SetHost("domain-1.com")
ctx.Request.Header.SetProtocol("https")
ctx.Request.Header.SetHost("domain-1.com")
ctx.Request.Header.Set(fiber.HeaderReferer, "https://safe.domain-1.com/api/callback?code=abc")
ctx.Request.Header.Set(HeaderName, token)
ctx.Request.Header.SetCookie(ConfigDefault.CookieName, token)
h(ctx)
require.Equal(t, 200, ctx.Response.StatusCode())
}

func Test_CSRF_TrustedOrigins_InvalidOrigins(t *testing.T) {
Expand Down
Loading