🐛 Request Header Fields Too Large when running CSRF and encrypt cookie middleware

[sevaho]

Fiber version 2

Issue description

When running following script in a browser you will notice that the cookie value is growing by continuous encrypting the value. The browser will respond with Request Header Fields Too Large when cookie is too big.

Code snippet

package main

import "github.com/gofiber/fiber/v2"
import "github.com/gofiber/fiber/v2/middleware/csrf"
import "github.com/gofiber/fiber/v2/middleware/encryptcookie"

func main() {
	app := fiber.New()

	app.Use(csrf.New())

    // cookie value generated by running `cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1`
	app.Use(encryptcookie.New(encryptcookie.Config{
		Key: "VWY9XBVap74Zpd0ckbT1reTl0NM6pz7R"}))

	app.Get("/", func(c *fiber.Ctx) error {
		return c.SendString("Hello, World 👋!")
	})

	app.Listen(":3000")
}

[welcome]

Thanks for opening your first issue here! 🎉 Be sure to follow the issue template! If you need help or want to chat with us, join us on Discord https://gofiber.io/discord

[fearofcode]

I can reproduce this on the latest fiber release.

If you run the above code and keep refreshing, the _csrf cookie value eventually becomes too large.

[vinay03]

For time being, changing the order of registering middlewares seems to be avoiding the issue.
Actually, encryptcookie middleware decrypts all cookies from Request Headers and set them again for further use. Then, in the end, it encrypts all cookies from Response Headers and set them again before sending out to Client. This design structure makes it compulsory to register encryptcookie middleware before any other middleware that deals with cookies(For e.g. CSRF).

package main

import (
	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/csrf"
	"github.com/gofiber/fiber/v2/middleware/encryptcookie"
)

func main() {
	app := fiber.New()

	// cookie value generated by running `cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1`
	app.Use(encryptcookie.New(encryptcookie.Config{
		Key: "VWY9XBVap74Zpd0ckbT1reTl0NM6pz7R"}))

	app.Use(csrf.New())

	app.Get("/", func(c *fiber.Ctx) error {
		return c.SendString("Hello, World!")
	})

	app.Listen(":3000")
}

[ReneWerner87]

#1343
@amir9480 can you help us with this problem

[silviucm]

To what @vinay03 mentioned, I would like to add that technically, the encryptcookie middleware already supports skipping cookies by name via the Except field at config time. So for csrf, one could just skip it, since it has its own generation ops (assuming below that the codebase keeps the default csrf cookie name as csrf_ )

	// cookie value generated by running `cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1`
	app.Use(encryptcookie.New(encryptcookie.Config{
		Key: "VWY9XBVap74Zpd0ckbT1reTl0NM6pz7R", Except: []string{"csrf_"}}))

With that added, you can use csrf independently positioned

[sevaho]

Thanks @silviucm I'll close the issue, as it not an issue anymore but a small bug.

[amir9480]

@ReneWerner87
Sorry for the late response, I made a PR to fix this issue