🤗 [Question]: CSRF check is failing about fiber HOT 3 CLOSED

@sixcolors can you support here

from fiber.

Thanks for opening your first issue here! 🎉 Be sure to follow the issue template! If you need help or want to chat with us, join us on Discord https://gofiber.io/discord

from fiber.

@vijrcafinnovation I have reviewed your code snippet and log and the middleware is returning an Sentinel Error, ErrNoReferer. This is a correct behaviour when a callback is received from an OATH2 POST request originating from an Azure-Identity-Platform served page as it is a Cross-Site Request.

The middleware has been designed to perform Strict Referer Checking. Which is a defence-in-depth measure that was implemented along with the remediation for a critical vulnerability known as CVE-2023-45128.

As this is not a bug, I have changed your issue to a question and recommend using a different approach to store and verify the token in the callback.

You could opt to use pre-sessions and store the token you expect to receive in the OAuth2 callbacks 'state' parameter within the session. This would also allow you to use the Synchronizer Token Pattern (with Session) for better security. In addition, you should consider using PKCE as an alternative or in addition to a token returned in the callback 'state' parameter.

See also the fiber recipe csrf-with-session.

Let me know if you need further help.

from fiber.