fiber: 🤗 [Question]: 403 forbidden on POST CSRF request

Question Description

Hi, I’ve set up the frontend and backend to both use HTTPS. I’m trying to create the Synchronizer Token Pattern CSRF Login pre-session using the CSRF middleware. I have a GET response that sets up the CSRF and Session tokens but the POST fails. The header seems to be identically named, the headers are there, both frontend and backend (AllowHeaders: “content-type,x-csrf-token”), but I get this 403 error.

Code attached. Am I missing something?

Code Snippet (optional)

Backend code:

presessionConfig := csrf.Config{
		Session:        sessionManager,
		Storage:        memoryStorage, 
		KeyLookup:      "header:X-CSRF-Token", // I feel that here's the issue, but I don't see how
		CookieName:     "__Host-csrf",
		CookieSameSite: "Lax",
		CookieSecure:   true,
		CookieHTTPOnly: false,
		ContextKey:     "csrf", // and that this might interfere somehow
		ErrorHandler:   csrfErrorHandler,
		Expiration:     30 * time.Minute,
	}
	presessionMiddleware := csrf.New(presessionConfig)

	app.Get("/login", presessionMiddleware, func(c *fiber.Ctx) error {
		csrfToken, ok := c.Locals("csrf").(string)
		if !ok {
			return c.SendStatus(fiber.StatusInternalServerError)
		}

		sessionTokenUUID := uuid.New()
		sessionTokenString := sessionTokenUUID.String()
		err := memoryStorage.Set(sessionTokenString, []byte("tempTest"), 120*time.Second)
		if err != nil {
			return err
		}

		return c.Status(fiber.StatusOK).JSON(fiber.Map{
			"csrf":    csrfToken,
			"session": sessionTokenString,
		})
	})

	app.Post("/login", presessionMiddleware, func(c *fiber.Ctx) error {
		... stuff happens here. Nothing to throw a 403 error here, at all. ...
		return c.SendStatus(200)
	})

Frontend request:

export async function getUser(data: { email: string; password: string, csrf: string }): Promise<any> {
    const response = await fetch(
        "https://localhost:3000/login",
        {
            method: "POST",
            mode: "cors",
            credentials: "include",
            headers: {
                "Content-Type": "application/json",
                "X-CSRF-Token": data.csrf,
                cookie: "__Host-csrf="+data.csrf
            },
            body: JSON.stringify(data)
        },
    )
    return response.json()
}

Checklist:

• I agree to follow Fiber’s Code of Conduct.
• I have checked for existing issues that describe my questions prior to opening this one.
• I understand that improperly formatted questions may be closed without explanation.