Bug Description

Discord discussion

The middleware randomly starts responding with 403 Forbidden if it's configured to look up for header:X-Csrf-Token. I found that the storage's map keys are messing up with random header values, so possibly this has something to do with unsafe magic.

One moment you have a map entry with a valid key which is actually a recently added CSRF token, a couple of requests ago you check this map and you see a random header value that replaced the first characters of the key, it can't be found by the middleware which results in returning the Forbidden response.

How to Reproduce

Steps to reproduce the behavior:

1. Use a default CSRF middleware for all your endpoints
2. Obtain your token with the GET request
3. Keep making POST requests and eventually you'll get 403 Forbidden

Expected Behavior

Technically, storage's map keys shouldn't mess up with random header values. CSRF middleware working correctly.

Fiber Version

v2.34.1

Code Snippet (optional)

No response

Checklist:

• I agree to follow Fiber's Code of Conduct.
• I have checked for existing issues that describe my problem prior to opening this one.
• I understand that improperly formatted bug reports may be closed without explanation.