Function refererMatchesHost

middleware/csrf/csrf.go:392–420

refererMatchesHost checks that the referer header matches the host header returns an error if the referer header is not present or is invalid returns nil if the referer header is valid

(c fiber.Ctx, trustedOrigins []string, trustedSubOrigins []subdomain)

// returns an error if the referer header is not present or is invalid
// returns nil if the referer header is valid
func refererMatchesHost(c fiber.Ctx, trustedOrigins []string, trustedSubOrigins []subdomain) error {
	referer := utilsstrings.ToLower(c.Get(fiber.HeaderReferer))
	if referer == "" {
		return ErrRefererNotFound
	}

	refererURL, err := url.Parse(referer)
	if err != nil {
		return ErrRefererInvalid
	}

	if schemehost.Match(refererURL.Scheme, refererURL.Host, c.Scheme(), c.Host()) {
		return nil
	}

	refererOrigin := refererURL.Scheme + "://" + refererURL.Host

	if slices.Contains(trustedOrigins, refererOrigin) {
		return nil
	}

	for _, trustedSubOrigin := range trustedSubOrigins {
		if trustedSubOrigin.match(refererOrigin) {
			return nil
		}
	}

	return ErrRefererNoMatch
}