CSRF — "referer not supplied" and what it means

Code

Diagnose and fix — the dev exemption + the token

The diagnosis. "referer not supplied" is the Origin/Referer half of the defense talking — not the token half. gorilla/csrf assumes production HTTPS, so for every unsafe request it demands proof of same-secure-origin: a valid Origin or Referer header over TLS. Your dev server is plain http://localhost, which offers no such proof, so the check rejects the request before it ever looks at the token. That's why adding a token field alone wouldn't have helped — you have to get past the origin check first.

So the fix is two moves: (a) tell the middleware "this request really is plaintext HTTP" in dev only, and (b) give the forms their token so the second half passes too.

Five files as tabs: router.go → nav.go → auth.go → auth.templ → layout.templ.

1. internal/handlers/router.go (modify) — the dev-only exemption, added before csrf.Protect:

if !h.Cfg.IsProd() {
	r.Use(func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
			next.ServeHTTP(w, csrf.PlaintextHTTPRequest(req))
		})
	})
}

PlaintextHTTPRequest relaxes only the Origin/Referer check, and only when !IsProd(). Production (HTTPS at Railway's edge) never runs this, so its strict origin protection stays fully armed. The token check is untouched in both.

2. internal/web/nav.go (modify) — Nav gains a CSRFToken field.

3. internal/handlers/auth.go (modify) — nav() fills it: web.Nav{CSRFToken: csrf.Token(r)}. (csrf.Token reads the per-request token the middleware set.)

4. internal/web/auth.templ (modify) — an authCSRF helper renders the hidden field, and every form calls it:

templ authCSRF(token string) {
	<input type="hidden" name="gorilla.csrf.Token" value={ token }/>
}
// inside each <form>:  @authCSRF(nav.CSRFToken)

5. internal/web/layout.templ (modify) — the logout form in the header gets the same hidden field.

Verify — it works now. templ generate && go run ./cmd/signflow. Log in: you reach the dashboard. Register, log out — all fine. View source on /login and you'll see the token:

<input type="hidden" name="gorilla.csrf.Token" value="Ck3p...long-random...">

And the forgery still fails: a POST without the field is rejected even in dev (the token half is always on):

$ curl -si -X POST localhost:8080/login -d 'email=a@b.co&password=x' | head -1
HTTP/1.1 403 Forbidden        ← no token → still blocked. Exactly right.

HTMX and the X-CSRF-Token header. Later, uploads POST via HTMX with a multipart body. Re-reading that body just to find a hidden field is wasteful — so gorilla/csrf also accepts the token in an X-CSRF-Token header. Put the token in a <meta> tag and have HTMX send it on every request:
<meta name="csrf-token" content={ nav.CSRFToken }/>
<body hx-headers='{"X-CSRF-Token": "…"}'>
Same token, sent in a header instead of the body — the multipart upload validates without anyone re-parsing it. You'll use this in the documents phase.

The lesson wasn't the fix — it was the 403. You now know CSRF defense is two checks: prove same-origin intent (Origin/Referer) and echo a secret token. The token is the half everyone remembers; the origin check is the half that 403'd you. Both have to pass.

router.go MODIFY 13 lines changed

Edit this file in internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
	"github.com/gorilla/csrf"
)

// Router builds the Chi router with the middleware stack and all routes.
//
// csrfKey must be 32 bytes; it authenticates the CSRF token cookie.
func (h *Handlers) Router(staticFS fs.FS, csrfKey []byte) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// In dev we serve plaintext HTTP on localhost. gorilla/csrf otherwise assumes
	// TLS and enforces a strict Origin/Referer check that rejects http:// origins.
	// Marking dev requests plaintext relaxes that ONE check while keeping the
	// token check. Production (HTTPS at Railway's edge) is NOT marked, so it keeps
	// the full strict-origin protection.
	if !h.Cfg.IsProd() {
		r.Use(func(next http.Handler) http.Handler {
			return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
				next.ServeHTTP(w, csrf.PlaintextHTTPRequest(req))
			})
		})
	}

	// CSRF: enforced on all unsafe methods (POST/PUT/PATCH/DELETE). Safe methods
	// pass through but get the token cookie set so forms can embed it. The field
	// name matches the hidden input our templates render.
	csrfMW := csrf.Protect(
		csrfKey,
		csrf.Secure(h.Cfg.IsProd()),
		csrf.Path("/"),
		csrf.SameSite(csrf.SameSiteLaxMode),
		csrf.FieldName("gorilla.csrf.Token"),
	)
	r.Use(csrfMW)

	// Resolve the session cookie into the request context for every route.
	r.Use(h.LoadUser)

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	// Public routes.
	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes.
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)
	r.Get("/login", h.LoginForm)
	r.Post("/login", h.Login)
	r.Post("/logout", h.Logout)

	// Authenticated routes.
	r.Group(func(pr chi.Router) {
		pr.Use(h.RequireAuth)
		pr.Get("/dashboard", h.Dashboard)
	})

	return r
}

nav.go MODIFY 5 lines changed

Edit this file in internal/web/

package web

// Nav carries the per-request bits the layout header needs: whether someone is
// signed in, their email, and the CSRF token (for the logout form, which is a
// POST, and for any other form the page renders).
type Nav struct {
	LoggedIn  bool
	Email     string
	CSRFToken string
}

auth.go MODIFY 3 lines changed

Edit this file in internal/handlers/

package handlers

import (
	"errors"
	"net/http"
	"net/mail"
	"strings"

	"github.com/gorilla/csrf"
	"github.com/jackc/pgx/v5"

	"github.com/programuoki/signflow/internal/auth"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

// nav builds the per-request nav model (current user + CSRF token) for templates.
func (h *Handlers) nav(r *http.Request) web.Nav {
	n := web.Nav{CSRFToken: csrf.Token(r)}
	if u, ok := UserFrom(r.Context()); ok {
		n.LoggedIn = true
		n.Email = u.Email
	}
	return n
}

// --- Register ---

func (h *Handlers) RegisterForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Register(h.nav(r), "", ""))
}

func (h *Handlers) Register(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")

	fail := func(msg string) {
		render(w, r, http.StatusUnprocessableEntity, web.Register(h.nav(r), emailAddr, msg))
	}

	if !validEmail(emailAddr) {
		fail("Please enter a valid email address.")
		return
	}
	if password != confirm {
		fail("Passwords do not match.")
		return
	}
	hash, err := auth.HashPassword(password)
	if errors.Is(err, auth.ErrPasswordLength) {
		fail("Password must be between 8 and 64 characters.")
		return
	}
	if err != nil {
		h.serverError(w, r, "hash password", err)
		return
	}

	// The UNIQUE constraint on email is the real guard; check first for a nice
	// message, and still handle the race by inspecting the insert error.
	if _, err := h.Queries.GetUserByEmail(r.Context(), emailAddr); err == nil {
		fail("That email is already registered. Try logging in.")
		return
	} else if !errors.Is(err, pgx.ErrNoRows) {
		h.serverError(w, r, "lookup user", err)
		return
	}

	user, err := h.Queries.CreateUser(r.Context(), db.CreateUserParams{
		Email:        emailAddr,
		PasswordHash: hash,
	})
	if err != nil {
		if isUniqueViolation(err) {
			fail("That email is already registered. Try logging in.")
			return
		}
		h.serverError(w, r, "create user", err)
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user registered", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

// --- Login / Logout ---

func (h *Handlers) LoginForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Login(h.nav(r), "", ""))
}

func (h *Handlers) Login(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")

	// One generic message for every failure mode avoids leaking which emails
	// are registered.
	invalid := func() {
		render(w, r, http.StatusUnprocessableEntity, web.Login(h.nav(r), emailAddr, "Invalid email or password."))
	}

	user, err := h.Queries.GetUserByEmail(r.Context(), emailAddr)
	if errors.Is(err, pgx.ErrNoRows) {
		invalid()
		return
	}
	if err != nil {
		h.serverError(w, r, "lookup user", err)
		return
	}
	if !auth.CheckPassword(user.PasswordHash, password) {
		invalid()
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user logged in", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

func (h *Handlers) Logout(w http.ResponseWriter, r *http.Request) {
	if err := h.Sessions.Destroy(r.Context(), w, r); err != nil {
		h.serverError(w, r, "destroy session", err)
		return
	}
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// --- Dashboard ---

func (h *Handlers) Dashboard(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Dashboard(h.nav(r)))
}

// --- helpers ---

func normalizeEmail(s string) string { return strings.ToLower(strings.TrimSpace(s)) }

func validEmail(s string) bool {
	if s == "" || len(s) > 254 {
		return false
	}
	_, err := mail.ParseAddress(s)
	return err == nil
}

auth.templ MODIFY 7 lines changed

Edit this file in internal/web/

package web

// authCSRF renders the hidden field gorilla/csrf expects on every POST form.
templ authCSRF(token string) {
	<input type="hidden" name="gorilla.csrf.Token" value={ token }/>
}

templ Register(nav Nav, email, errMsg string) {
	@Layout("Register", nav) {
		<div class="card auth-card">
			<h1>Create your account</h1>
			if errMsg != "" {
				<div class="flash flash-error">{ errMsg }</div>
			}
			<form method="post" action="/register" class="form">
				@authCSRF(nav.CSRFToken)
				<div class="field">
					<label for="email">Email</label>
					<input id="email" name="email" type="email" value={ email } required autofocus/>
				</div>
				<div class="field">
					<label for="password">Password</label>
					<input id="password" name="password" type="password" minlength="8" maxlength="64" required/>
				</div>
				<div class="field">
					<label for="confirm">Confirm password</label>
					<input id="confirm" name="confirm" type="password" minlength="8" maxlength="64" required/>
				</div>
				<button class="btn btn-primary" type="submit">Create account</button>
			</form>
			<p class="muted">Already have an account? <a href="/login">Log in</a>.</p>
		</div>
	}
}

templ Login(nav Nav, email, errMsg string) {
	@Layout("Log in", nav) {
		<div class="card auth-card">
			<h1>Log in</h1>
			if errMsg != "" {
				<div class="flash flash-error">{ errMsg }</div>
			}
			<form method="post" action="/login" class="form">
				@authCSRF(nav.CSRFToken)
				<div class="field">
					<label for="email">Email</label>
					<input id="email" name="email" type="email" value={ email } required autofocus/>
				</div>
				<div class="field">
					<label for="password">Password</label>
					<input id="password" name="password" type="password" required/>
				</div>
				<button class="btn btn-primary" type="submit">Log in</button>
			</form>
			<p class="muted">No account? <a href="/register">Register</a>.</p>
		</div>
	}
}

layout.templ MODIFY 1 line changed

Edit this file in internal/web/

package web

// Layout is the shared HTML shell. Page templates call it and pass their body
// as children. htmx is vendored under /static/js so the app has no runtime CDN
// dependency.
templ Layout(title string, nav Nav) {
	<!DOCTYPE html>
	<html lang="en">
		<head>
			<meta charset="utf-8"/>
			<meta name="viewport" content="width=device-width, initial-scale=1"/>
			<title>{ title } · SignFlow</title>
			<link rel="stylesheet" href="/static/css/style.css"/>
			<script src="/static/js/htmx.min.js"></script>
		</head>
		<body>
			<header class="topbar">
				<a href="/" class="brand">✍️ SignFlow</a>
				<nav class="topnav">
					if nav.LoggedIn {
						<a href="/dashboard">Dashboard</a>
						<span class="who">{ nav.Email }</span>
						<form method="post" action="/logout" class="inline-form">
							<input type="hidden" name="gorilla.csrf.Token" value={ nav.CSRFToken }/>
							<button type="submit" class="btn btn-ghost btn-sm">Log out</button>
						</form>
					} else {
						<a href="/login">Log in</a>
						<a href="/register" class="btn btn-primary btn-sm">Register</a>
					}
				</nav>
			</header>
			<main class="container">
				{ children... }
			</main>
			<footer class="footer">
				<p>SignFlow — reference app for the Programuoki server-side web track.</p>
			</footer>
		</body>
	</html>
}