CSRF — "referer not supplied" and what it means

Code

Turn on protection — and hit the 403

First the dependency:

go get github.com/gorilla/csrf

Three files as tabs, in dependency order: config.go → main.go → router.go — a secret to key the token, the derived key, and the middleware itself. All three are modifications.

1. internal/config/config.go (modify) — a SessionSecret, read from SESSION_SECRET. In dev it falls back to a fixed insecure value so things work out of the box; in prod it's required (a guard returns an error if it's missing). Everything else is carried forward.

2. cmd/signflow/main.go (modify) — derive a stable 32-byte key from the secret, so there's only one secret to manage:

csrfKey := sha256.Sum256([]byte("csrf:" + cfg.SessionSecret))
// ...
Handler: h.Router(staticFS, csrfKey[:]),   // ← Router now takes the key

3. internal/handlers/router.go (modify) — the protection itself:

csrfMW := csrf.Protect(
	csrfKey,
	csrf.Secure(h.Cfg.IsProd()),          // Secure cookie only in prod
	csrf.FieldName("gorilla.csrf.Token"), // the hidden field forms will carry
)
r.Use(csrfMW)

That's it — CSRF is now enforced on every POST.

Verify — and watch it break. Regenerate and run, then try to log in:

go run ./cmd/signflow

Open http://localhost:8080/login, enter your credentials, submit. Instead of your dashboard:

Forbidden - referer not supplied

A 403. On your own login form. With correct credentials. And the message — "referer not supplied" — tells you nothing about what's actually wrong. This is the error every Go developer hits once and burns an afternoon on.

Confirm it from the command line too:

$ curl -si -X POST localhost:8080/login -d 'email=a@b.co&password=x' | head -1
HTTP/1.1 403 Forbidden

Don't fix it yet. Sit with it for a second. Your form has no token field, and you're on http:// — but the error doesn't mention tokens at all; it complains about the referer. That's the clue. The next step explains exactly why, and fixes it in two moves.

config.go MODIFY 15 lines changed

Edit this file in internal/config/

// Package config loads runtime configuration from the environment.
//
// In development we lean on sensible defaults so you can `go run` the app with
// zero setup. In production every value is expected to come from the
// environment (Railway injects them). The struct GROWS as the app does — the
// database URL arrives in lesson 3, the session secret in lesson 4, and so on.
package config

import (
	"fmt"
	"os"

	"github.com/joho/godotenv"
)

type Config struct {
	// DatabaseURL is a standard libpq/pgx connection string.
	DatabaseURL string
	// Port is the TCP port the HTTP server listens on. Railway sets $PORT.
	Port string
	// Env is "dev" or "prod". Later it flips cookie Secure flags and the email
	// sender; for now it is just a label.
	Env string
	// BaseURL is the public origin used to build absolute links (in emails,
	// later). In dev it is http://localhost:PORT.
	BaseURL string
	// SessionSecret authenticates the CSRF token cookie. Must be set in prod.
	SessionSecret string
}

// IsProd reports whether we are running in production. One flag, read in many
// places later (Secure cookies, strict CSRF).
func (c Config) IsProd() bool { return c.Env == "prod" }

// Load reads configuration, applying dev-friendly defaults.
func Load() (Config, error) {
	_ = godotenv.Load() // best-effort; load a local .env if present, else shrug

	cfg := Config{
		DatabaseURL:   getenv("DATABASE_URL", "postgres://postgres@localhost:5432/signflow?sslmode=disable"),
		Port:          getenv("PORT", "8080"),
		Env:           getenv("APP_ENV", "dev"),
		BaseURL:       os.Getenv("BASE_URL"),
		SessionSecret: os.Getenv("SESSION_SECRET"),
	}
	if cfg.BaseURL == "" {
		cfg.BaseURL = "http://localhost:" + cfg.Port
	}

	if cfg.IsProd() && os.Getenv("BASE_URL") == "" {
		return Config{}, fmt.Errorf("BASE_URL is required in production")
	}
	if cfg.IsProd() && cfg.SessionSecret == "" {
		return Config{}, fmt.Errorf("SESSION_SECRET is required in production")
	}
	if cfg.SessionSecret == "" {
		// Dev-only fallback so CSRF works out of the box; never used in prod
		// because of the guard above.
		cfg.SessionSecret = "dev-insecure-session-secret-change-me"
	}

	return cfg, nil
}

func getenv(key, fallback string) string {
	if v := os.Getenv(key); v != "" {
		return v
	}
	return fallback
}

main.go MODIFY 6 lines changed

Edit this file in cmd/signflow/

// Command signflow is the HTTP server entrypoint.
//
// On startup it: loads config, runs embedded goose migrations, opens a pgx
// pool, builds the Chi router, and serves with graceful shutdown.
package main

import (
	"context"
	"crypto/sha256"
	"errors"
	"fmt"
	"io/fs"
	"log/slog"
	"net/http"
	"os"
	"os/signal"
	"syscall"
	"time"

	"github.com/jackc/pgx/v5/stdlib"
	"github.com/pressly/goose/v3"

	migrations "github.com/programuoki/signflow/db"
	"github.com/programuoki/signflow/internal/config"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/handlers"
	"github.com/programuoki/signflow/internal/session"
	"github.com/programuoki/signflow/static"
)

func main() {
	log := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
	if err := run(log); err != nil {
		log.Error("fatal", "err", err)
		os.Exit(1)
	}
}

func run(log *slog.Logger) error {
	cfg, err := config.Load()
	if err != nil {
		return err
	}
	log.Info("starting signflow", "env", cfg.Env, "port", cfg.Port, "base_url", cfg.BaseURL)

	ctx := context.Background()

	// 1. Migrate. We use a throwaway database/sql handle (pgx stdlib driver)
	//    because goose speaks database/sql, then hand the app a pgx pool.
	if err := runMigrations(cfg.DatabaseURL, log); err != nil {
		return err
	}

	// 2. Connect the application pool the sqlc queries run against.
	pool, err := db.Connect(ctx, cfg.DatabaseURL)
	if err != nil {
		return err
	}
	defer pool.Close()

	queries := db.New(pool)
	sessions := session.NewManager(queries, cfg.IsProd())
	h := handlers.New(cfg, queries, sessions, log)

	staticFS, err := fs.Sub(static.FS, "assets")
	if err != nil {
		return err
	}

	// Derive a stable 32-byte CSRF key from the session secret so there is only
	// one secret to manage.
	csrfKey := sha256.Sum256([]byte("csrf:" + cfg.SessionSecret))

	srv := &http.Server{
		Addr:              ":" + cfg.Port,
		Handler:           h.Router(staticFS, csrfKey[:]),
		ReadHeaderTimeout: 10 * time.Second,
	}

	// Graceful shutdown: stop accepting on SIGINT/SIGTERM, then drain in-flight
	// requests for up to 15s before exiting.
	shutdownCtx, stop := signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
	defer stop()

	go func() {
		log.Info("listening", "addr", srv.Addr)
		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
			log.Error("server error", "err", err)
			stop()
		}
	}()

	<-shutdownCtx.Done()
	log.Info("shutting down")

	timeout, cancel := context.WithTimeout(context.Background(), 15*time.Second)
	defer cancel()
	return srv.Shutdown(timeout)
}

// runMigrations applies all pending goose migrations from the embedded FS.
func runMigrations(databaseURL string, log *slog.Logger) error {
	sqlDB, err := goose.OpenDBWithDriver("pgx", databaseURL)
	if err != nil {
		return err
	}
	defer sqlDB.Close()

	goose.SetBaseFS(migrations.FS)
	goose.SetLogger(gooseLogger{log})
	if err := goose.SetDialect("postgres"); err != nil {
		return err
	}
	return goose.Up(sqlDB, "migrations")
}

// gooseLogger adapts slog to goose's logger interface.
type gooseLogger struct{ log *slog.Logger }

func (g gooseLogger) Fatalf(format string, v ...interface{}) {
	g.log.Error("goose", "msg", fmt.Sprintf(format, v...))
}
func (g gooseLogger) Printf(format string, v ...interface{}) {
	g.log.Info("goose", "msg", fmt.Sprintf(format, v...))
}

// ensure the pgx stdlib driver is registered for goose.OpenDBWithDriver("pgx", ...)
var _ = stdlib.GetDefaultDriver

router.go MODIFY 16 lines changed

Edit this file in internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
	"github.com/gorilla/csrf"
)

// Router builds the Chi router with the middleware stack and all routes.
//
// csrfKey must be 32 bytes; it authenticates the CSRF token cookie.
func (h *Handlers) Router(staticFS fs.FS, csrfKey []byte) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// CSRF: enforced on all unsafe methods (POST/PUT/PATCH/DELETE). Safe methods
	// pass through but get the token cookie set so forms can embed it. The field
	// name matches the hidden input our templates render.
	csrfMW := csrf.Protect(
		csrfKey,
		csrf.Secure(h.Cfg.IsProd()),
		csrf.Path("/"),
		csrf.SameSite(csrf.SameSiteLaxMode),
		csrf.FieldName("gorilla.csrf.Token"),
	)
	r.Use(csrfMW)

	// Resolve the session cookie into the request context for every route.
	r.Use(h.LoadUser)

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	// Public routes.
	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes.
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)
	r.Get("/login", h.LoginForm)
	r.Post("/login", h.Login)
	r.Post("/logout", h.Logout)

	// Authenticated routes.
	r.Group(func(pr chi.Router) {
		pr.Use(h.RequireAuth)
		pr.Get("/dashboard", h.Dashboard)
	})

	return r
}