⚡ Performance

Fiber v3.6.0 ships with fasthttp v1.75.0. With it, Fiber v3 is back on par with the speed of v2, despite the additional security mechanisms built in since then.

Negative is faster than v2. v3.6.0 was measured on main three days before the release. All scenarios are published on our benchmarks page, where we now continuously make sure that v3 does not get slower again. https://gofiber.github.io/benchmarks/

🚀 New

• Add csrf.NewCrossOriginProtection for tokenless CSRF protection (#4596) New tokenless middleware that rejects unsafe cross-origin browser requests by their Sec-Fetch-Site and Origin headers; no cookie, token or storage needed.

  app.Use(csrf.NewCrossOriginProtection(csrf.CrossOriginConfig{
      TrustedOrigins: []string{"https://admin.example.com"},
  }))

  https://docs.gofiber.io/middleware/csrf#cross-origin-protection-without-tokens
• Update fasthttp to v1.75.0 (#4667, #4740) fasthttp v1.75.0 (from v1.73.0) parses and validates request headers in one pass, writes responses with fewer copies, serves cached files up to 8 KiB from memory and speeds up URI processing. https://github.com/valyala/fasthttp/releases/tag/v1.75.0
• Raise default ReadBufferSize and WriteBufferSize to 8 KB (#4715) ReadBufferSize and WriteBufferSize now default to 8192 bytes (was 4096), which also raises the default request header limit; explicitly configured values are kept.

  app := fiber.New(fiber.Config{
      ReadBufferSize:  4096, // previous default, now 8192
      WriteBufferSize: 4096, // previous default, now 8192
  })

  https://docs.gofiber.io/api/fiber#readbuffersize
• Expand context, response and request helpers (#4638) New helpers on Req, Res and Ctx such as Bearer, Origin, IsSafe, Del, StatusCode, GetCookies, Elapsed and RouteName; request helpers are now also reachable through c.Req().

  token := c.Bearer()   // "abc123" for "Authorization: Bearer abc123"
  c.Del("X-Powered-By") // remove a response header
  took := c.Elapsed()   // time spent on this request so far

  https://docs.gofiber.io/api/ctx
• Add Endpoint() for middleware look-ahead (#4601) New c.Endpoint() returns the route that will handle the request without advancing the handler chain (nil on 404/405).

  app.Use(func(c fiber.Ctx) error {
      if route := c.Endpoint(); route != nil {
          // enforce access control using route.Path or route.Name
      }
      return c.Next()
  })

  https://docs.gofiber.io/api/ctx#endpoint
• Add ordered RuleList to the redirect and rewrite middleware (#4621, #4633) New RuleList []Rule in redirect and rewrite is tried in the order written, first match wins; the Rules map is deprecated and setting both panics.

  app.Use(redirect.New(redirect.Config{
      RuleList: []redirect.Rule{
          {From: "/old", To: "/new"},      // checked first
          {From: "/old/*", To: "/new/$1"}, // takes everything else
      },
  }))

  https://docs.gofiber.io/middleware/redirect#rule-order
• Render configured templates to a writer (#4594) New app.Render writes a template through the configured view engine to any io.Writer without creating an HTTP response, e.g. for SSE or HTMX partials.

  var buf bytes.Buffer
  if err := app.Render(&buf, "partial", fiber.Map{"Title": "update"}); err != nil {
      return err
  }

  https://docs.gofiber.io/api/app#render
• Add final request hooks to the HTTP client (#4595) New AddFinalRequestHook runs after the built-in hooks, immediately before the request is sent, when RawRequest holds the resolved URL, merged headers and serialized body.

  cc.AddFinalRequestHook(func(_ *client.Client, req *client.Request) error {
      raw := req.RawRequest
      raw.Header.Set("X-Signature", sign(raw.URI().RequestURI(), raw.URI().Host(), raw.Body()))
      return nil
  })

  https://docs.gofiber.io/client/hooks#final-request-hooks
• Add SetLocal, a request-local store without the variadic's heap slice (#4687) New c.SetLocal(key, value) stores a request-local value exactly like c.Locals(key, value), without the one-element slice that call allocates. https://docs.gofiber.io/api/ctx#setlocal
• Add DisableFlashMessages and filter route candidates with a probe constant (#4655) New fiber.Config option DisableFlashMessages turns off redirect flash messages and the per-request fiber_flash cookie scan (off by default); the router gains a precomputed probe-constant filter.

  app := fiber.New(fiber.Config{
      DisableFlashMessages: true, // default: false
  })

  https://docs.gofiber.io/api/fiber#disableflashmessages
• Add source-aware extraction to extractors without a new struct field (#4603) New extractors.Resolve returns the value together with the Source and Key of the chain child that produced it; the Extractor struct is unchanged.

  ex := extractors.Chain(extractors.FromHeader("X-API-Key"), extractors.FromQuery("api_key"))
  res, err := extractors.Resolve(ex, c)
  // res.Value, plus res.Source and res.Key of the child that won

  https://docs.gofiber.io/guide/extractors#source-aware-extraction

🧹 Updates

• Require Go 1.26 (#4654)
• Filter large route buckets before loading routes and bind without building a map (#4705)
• Filter a route bucket by static path before loading the route (#4688)
• Consolidate route pattern preprocessing (#4710)
• Share route and client :name path delimiters (#4636)
• Normalize header keys in one pass and match canonical media types directly (#4690)
• Share streaming header join logic (#4734)
• Consolidate comma-list header scanning into internal/headerlist (#4637)
• Consolidate entity-tag parsing into internal/etag (#4632)
• Adopt utils/v2 helpers and cut per-request allocations in the hot path (#4666)
• cors/csrf: Consolidate origin matching into internal/origin (#4653)
• limiter: Lock keys per shard instead of globally (#4702)
• redirect/rewrite: Share capture substitution (#4749)
• session: Skip the gob re-encode when a session was only read (#4703)
• Cut the per-request cost of the extractors (#4678)
• Stabilize flaky tests in limiter, binder, cache, basicauth and the request sweeps (#4729)
• Close three test coverage gaps in logger, shutdown and docs (#4615)
• Add a regression test and docs example for CustomCtx overrides behind middleware (#4598)
• Add a regression test and docs note that Context() is not canceled on graceful shutdown (#4599)
• Trigger Dependabot in gofiber/benchmarks after releases (#4682)

🐛 Fixes

• Normalize request paths per RFC 3986 before routing and serve the routed path from the static middleware (#4695)
• Keep stray percents from forging escapes, root every request target and take the SendFile name literally (#4719)
• Let empty optional params yield to later required segments (#4722)
• Fix panic on route pattern with trailing escape character (#4717)
• Preserve names for merged multi-method routes (#4663)
• Fix nil pointer dereference when a domain-mounted sub-app contains a nested mount (#4620)
• Preserve path rewrites whose source aliases the current path, such as c.Path(c.Path()[4:]) (#4674)
• Escape parameter values in generated route URLs (#4629)
• Return ErrRouteNotRepresentable for parameter values a generated route URL cannot represent (#4721)
• Accept tab OWS in X-Forwarded-For and share one OWS trim helper (#4735)
• Treat Vary field names as case-insensitive (#4642)
• Unify cookie SameSite handling (#4630)
• Prevent unbounded handler growth when SendFile serves a function-backed fs.FS (#4656)
• Prevent typed-nil view engine panics (#4662)
• Report the real status for fasthttp-level request errors (#4614)
• Drain in-flight requests before Listen returns (#4701)
• basicauth: Equalize verification time across mixed hash algorithms (#4726)
• basicauth: Refuse a repeated Authorization field (#4738)
• basicauth/keyauth: Use HTTP quoted strings in auth challenges (#4631)
• cache: Delete stale entries after uncacheable revalidation (#4590)
• cache: Key entries by request scheme and host (#4736)
• cache: Replay Vary on cache hits and mark credential-keyed entries private (#4744)
• compress: Honor repeated Accept-Encoding and Cache-Control lines with the new HasHeaderValue helper (#4708)
• idempotency: Keep replayed response headers unsplit under EnableSplittingOnParsers (#4693)
• limiter: Bound the rate-limit key before it reaches storage (#4677)
• proxy: Apply the client's Connection listing to the request as received (#4745)
• proxy: Fold DomainForward's configured hostname to Punycode (#4673)
• proxy: Overwrite X-Real-IP in proxy.Balancer like the other forwarding helpers (#4725)
• proxy: Preserve IPv6 brackets in domain forwarding (#4689)
• redirect/rewrite: Read "$10" as the tenth capture in targets (#4692)
• session: Honor chain-level extractors and close three write-back holes (#4679)
• static: Align file resolution with routed paths (#4712)
• static: Reject partial wildcard matches that cross a path segment boundary (#4728)
• Decode a path parameter exactly once in FromParam (#4626)
• Anchor and escape client path parameter substitution (#4625)
• Keep a stale client Response from releasing a reused Request on Close (#4659)
• Parse malformed Set-Cookie attributes in the client in linear time (#4658)
• Make static, proxy, adaptor and rewrite act on the path the router matched (#4720)
• Fix RFC 9110/9112 compliance gaps in core, static and timeout (#4747)
• Fix correctness issues across core, router, binder, client and middleware (#4652)

🛠️ Maintenance

41 changes

• bump the golang-modules group with 2 updates (#4748)
• bump github.com/fxamacker/cbor/v2 from 2.9.4 to 2.9.6 (#4746)
• bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 (#4743)
• bump github.com/valyala/fasthttp from 1.74.0 to 1.75.0 in the fasthttp-modules group (#4740)
• bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 (#4741)
• bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (#4739)
• bump github.com/tinylib/msgp from 1.6.4 to 1.6.5 (#4723)
• bump github.com/klauspost/compress from 1.20.0 to 1.20.1 (#4709)
• bump github.com/gofiber/schema from 1.8.7 to 1.8.8 (#4706)
• bump github.com/gofiber/utils/v2 from 2.6.0 to 2.6.1 (#4707)
• bump github.com/gofiber/utils/v2 from 2.5.3 to 2.6.0 (#4704)
• bump github.com/gofiber/utils/v2 from 2.5.2 to 2.5.3 (#4700)
• bump codecov/codecov-action from 7.1.0 to 7.1.1 (#4699)
• bump github.com/molecule-man/go-brrr from 1.1.0 to 1.1.1 (#4698)
• bump codecov/codecov-action from 7.0.0 to 7.1.0 (#4691)
• bump github.com/gofiber/schema from 1.8.6 to 1.8.7 (#4686)
• bump github.com/fxamacker/cbor/v2 from 2.9.3 to 2.9.4 (#4685)
• bump github.com/gofiber/utils/v2 from 2.5.1 to 2.5.2 (#4681)
• bump github.com/shamaton/msgpack/v3 from 3.2.2 to 3.2.3 (#4680)
• bump github.com/molecule-man/go-brrr from 1.0.1 to 1.1.0 (#4676)
• bump the golang-modules group with 3 updates (#4672)
• bump golang.org/x/sys from 0.47.0 to 0.48.0 in the golang-modules group (#4670)
• bump github.com/gofiber/schema from 1.8.5 to 1.8.6 (#4671)
• bump github.com/gofiber/utils/v2 from 2.5.0 to 2.5.1 (#4668)
• bump github.com/valyala/fasthttp from 1.73.0 to 1.74.0 in the fasthttp-modules group (#4667)
• bump streetsidesoftware/cspell-action from 9.0.1 to 9.1.0 (#4665)
• bump github.com/shamaton/msgpack/v3 from 3.2.1 to 3.2.2 (#4660)
• bump github.com/gofiber/utils/v2 from 2.4.3 to 2.5.0 (#4661)
• bump golang.org/x/crypto from 0.55.0 to 0.56.0 in the golang-modules group (#4651)
• bump github.com/gofiber/utils/v2 from 2.4.2 to 2.4.3 (#4650)
• bump github.com/klauspost/compress from 1.19.2 to 1.20.0 (#4649)
• bump github.com/gofiber/schema from 1.8.4 to 1.8.5 (#4647)
• bump github.com/shamaton/msgpack/v3 from 3.2.0 to 3.2.1 (#4645)
• bump github.com/andybalholm/brotli from 1.2.2 to 1.2.3 (#4639)
• bump github.com/gofiber/utils/v2 from 2.4.1 to 2.4.2 (#4634)
• bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#4627)
• bump streetsidesoftware/cspell-action from 8.4.0 to 9.0.1 (#4624)
• bump github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3 (#4623)
• bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#4622)
• bump the golang-modules group with 3 updates (#4611)
• bump github.com/gofiber/schema from 1.8.3 to 1.8.4 (#4609)

📚 Documentation

• Clarify that c.IP() walks the proxy chain only with EnableIPValidation (#4737)
• Explain what MIMETypes does to an existing format (#4664)
• Document the nested and array field notations in Bind (#4616)
• Add a minimal CRUD and healthcheck guide (#4696)
• Fix British to American English spellings across docs (#4697)
• Update README documentation links (#4711)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.5.0...v3.6.0

Thank you @00200200, @Arvin-Lee, @AshSgDe29071999, @BitWeaverDev, @Dev-next-gen, @Rachit-Gandhi, @ReneWerner87, @Rohilalala, @RubenPari, @VedantMadane, @ZihxS, @aditya-rohilla, @drakeo338, @evgenyponomarev, @fadiromdhan3, @fadiroot, @gaby, @h2zi, @haimingZZ, @ibraah007, @jabrailkhalil, @lazerg, @official-burak and @truongbo17 for making this release possible.