originMatchesHost() — fiber Function Reference

Architecture documentation for the originMatchesHost() function in csrf.go from the fiber codebase.

Function go FiberMiddleware Security called by 1

Entity Profile

FiberMiddleware→ Security→ originMatchesHost() — fiber Function Reference

Dependency Diagram

graph TD
  24ad66d8_6fe0_d570_4d4c_a6f8875f7c69["originMatchesHost()"]
  57b9eed3_6274_c073_f0db_e3c30b2a59fe["csrf.go"]
  24ad66d8_6fe0_d570_4d4c_a6f8875f7c69 -->|defined in| 57b9eed3_6274_c073_f0db_e3c30b2a59fe
  c524454a_687b_b78d_a451_724040543641["New()"]
  c524454a_687b_b78d_a451_724040543641 -->|calls| 24ad66d8_6fe0_d570_4d4c_a6f8875f7c69
  style 24ad66d8_6fe0_d570_4d4c_a6f8875f7c69 fill:#6366f1,stroke:#818cf8,color:#fff

Relationship Graph

Source Code

middleware/csrf/csrf.go lines 340–366

func originMatchesHost(c fiber.Ctx, trustedOrigins []string, trustedSubOrigins []subdomain) error {
	origin := utils.ToLower(c.Get(fiber.HeaderOrigin))
	if origin == "" || origin == "null" { // "null" is set by some browsers when the origin is a secure context https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin#description
		return errOriginNotFound
	}

	originURL, err := url.Parse(origin)
	if err != nil {
		return ErrOriginInvalid
	}

	if schemeAndHostMatch(originURL.Scheme, originURL.Host, c.Scheme(), c.Host()) {
		return nil
	}

	if slices.Contains(trustedOrigins, origin) {
		return nil
	}

	for _, trustedSubOrigin := range trustedSubOrigins {
		if trustedSubOrigin.match(origin) {
			return nil
		}
	}

	return ErrOriginNoMatch
}