Railway•4mo ago

Cross-site POST form submissions are forbidden [bug] same site

I'm posting to the same host screenshot included Origin: https://ponytron-frontend-production.up.railway.app Referer: https://ponytron-frontend-production.up.railway.app/

Solution:

disabled csrf in svelte.config.js: ``` kit: { // adapter-auto only supports some environments, see https://kit.svelte.dev/docs/adapter-auto for a list....

Jump to solution

13 Replies

Percy•4mo ago

Project ID: ae09b251-66fd-498b-8797-816b32b39aea

𝕯𝖊𝖒𝖔𝖓•4mo ago

ae09b251-66fd-498b-8797-816b32b39aea

Brody•4mo ago

what kind of frontend site is this? what's the tech stack?

𝕯𝖊𝖒𝖔𝖓•4mo ago

Sveltekit. The error is coming from railway proxy I think though. I don't see the error in my logs

Brody•4mo ago

can you send a link to where i could reproduce this error?

𝕯𝖊𝖒𝖔𝖓•4mo ago

Visit the url I included add try to login with any username password doesn't matter

Brody•4mo ago

on railway your app sits behind a proxy so i think the Sveltekit server is not reading the host correctly and thus is thinking you are doing a post request from a different domain, or something along those lines. look into getting Sveltekit to trust the proxy headers.

𝕯𝖊𝖒𝖔𝖓•4mo ago

K thx yeah it was on my end, working now

Brody•4mo ago

awsome, would you mind sharing the config change needed?

Solution

𝕯𝖊𝖒𝖔𝖓•4mo ago

disabled csrf in svelte.config.js:

    kit: {
        // adapter-auto only supports some environments, see https://kit.svelte.dev/docs/adapter-auto for a list.
        // If your environment is not supported or you settled on a specific environment, switch out the adapter.
        // See https://kit.svelte.dev/docs/adapters for more information about adapters.
        adapter: adapter(),
        csrf: {
            checkOrigin: false
        }
    }

    kit: {
        // adapter-auto only supports some environments, see https://kit.svelte.dev/docs/adapter-auto for a list.
        // If your environment is not supported or you settled on a specific environment, switch out the adapter.
        // See https://kit.svelte.dev/docs/adapters for more information about adapters.
        adapter: adapter(),
        csrf: {
            checkOrigin: false
        }
    }

I'm not using it anyway but probably not the best. there are env variables you can set at https://kit.svelte.dev/docs/adapter-node#environment-variables but I didn't go that route

Brody•4mo ago

alright, thank you!

Slaven•2mo ago

Is it safe to not check origin?

Brody•2mo ago

that's entirely up to you

Gaming

Programming

Cross-site POST form submissions are forbidden [bug] same site