diff --git a/docs/api/app.md b/docs/api/app.md index d44944f7dd..2fd98d6538 100644 --- a/docs/api/app.md +++ b/docs/api/app.md @@ -664,4 +664,4 @@ Hooks is a method to return [hooks](../guide/hooks.md) property. ```go title="Signature" func (app *App) Hooks() *Hooks -``` +``` \ No newline at end of file diff --git a/docs/api/middleware/cors.md b/docs/api/middleware/cors.md index 6fe996774e..2e48d1c9a1 100644 --- a/docs/api/middleware/cors.md +++ b/docs/api/middleware/cors.md @@ -214,4 +214,4 @@ When configuring CORS, misconfiguration can potentially expose your application - **Inadequate `AllowOriginsFunc` Validation**: When using `AllowOriginsFunc` for dynamic origin validation, ensure the function includes robust checks to prevent unauthorized origins from being accepted. Overly permissive validation can lead to security vulnerabilities. Never allow `AllowOriginsFunc` to return `true` for all origins. This is particularly crucial when `AllowCredentials` is set to `true`. Doing so can bypass the restriction of using a wildcard origin with credentials, exposing your application to serious security threats. If you need to allow wildcard origins, use `AllowOrigins` with a wildcard `"*"` instead of `AllowOriginsFunc`. -Remember, the key to secure CORS configuration is specificity and caution. By carefully selecting which origins, methods, and headers are allowed, you can help protect your application from cross-origin attacks. \ No newline at end of file +Remember, the key to secure CORS configuration is specificity and caution. By carefully selecting which origins, methods, and headers are allowed, you can help protect your application from cross-origin attacks. diff --git a/middleware/csrf/csrf.go b/middleware/csrf/csrf.go index d04394a89b..a04d85cb2f 100644 --- a/middleware/csrf/csrf.go +++ b/middleware/csrf/csrf.go @@ -318,7 +318,6 @@ func originMatchesHost(c fiber.Ctx, trustedOrigins []string, trustedSubOrigins [ // returns nil if the referer header is valid func refererMatchesHost(c fiber.Ctx, trustedOrigins []string, trustedSubOrigins []subdomain) error { referer := strings.ToLower(c.Get(fiber.HeaderReferer)) - if referer == "" { return ErrRefererNotFound }