LibreWolf Cl@ve Login Fix (invalid.sp.domain)

Accessing Spanish government portals (such as Agencia Tributaria, Seguridad Social, or municipal Padrón systems) via Cl@ve fails in LibreWolf with an invalid.sp.domain error during the authentication redirect loop.

Cause

LibreWolf enforces strict privacy defaults by setting network.http.referer.XOriginPolicy to 2 (trimming or omitting cross-origin referrer headers). Because the Cl@ve gateway (pasarela.clave.gob.es) relies on the HTTP referrer header to verify which service provider initiated the login request, stripping this header breaks the identity provider handshake.

Solution

Disable strict cross-origin referrer stripping so the handshaking header is preserved:

Open LibreWolf and navigate to Settings

Go to the LibreWolf section and untick Limit cross-origin referers.

Alternatively, open about:config, search for network.http.referer.XOriginPolicy, and change its value to 0.

Persistence

LibreWolf automatically persists this GUI setting across restarts inside your profile's failover.jsc file, so external .cfg overrides or user.js modifications are not required.

Posted

18:34 20/09/2026