Skip to content

checkOrigin in v6.0.0-beta.14 #15587

@devcustrom

Description

@devcustrom

Astro Info

Astro                    v6.0.0-beta.14
Node                     v22.22.0
System                   Windows (x64)
Package Manager          npm
Output                   server
Adapter                  @astrojs/node (v10.0.0-beta.4)
Integrations             @astrojs/vue (v6.0.0-beta.1)

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

I encountered this on a local machine immediately after upgrading from 5.17.1 to 6.0.0-beta.14. I get errors in actions Cross-site POST form submissions are forbidden checkOrigin: false solves this problem,
I am using caddy server before astro for https availability in development
Here are his logs

2026/02/20 06:27:38.690 ERROR http.log.error dial tcp [::1]:3001: connectex: No connection could be made because the target machine actively refused it. {"request": {"remote_ip": "::1", "remote_port": "64129", "client_ip": "::1", "proto": "HTTP/1.1", "method": "GET", "host": "my.test.localhost", "uri": "/", "headers": {"Sec-Websocket-Extensions": ["permessage-deflate; client_max_window_bits"], "Cache-Control": ["no-cache"], "User-Agent": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36"], "Origin": ["https://my.test.localhost"], "Sec-Websocket-Protocol": ["vite-ping"], "Connection": ["Upgrade"], "Pragma": ["no-cache"], "Upgrade": ["websocket"], "Sec-Websocket-Version": ["13"], "Accept-Language": ["ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7"], "Cookie": ["REDACTED"], "Accept-Encoding": ["gzip, deflate, br, zstd"], "Sec-Websocket-Key": ["lgHdA5gGi11nrea53cA58g=="]}, "tls": {"resumed": true, "version": 772, "cipher_suite": 4865, "proto": "http/1.1", "server_name": "my.test.localhost"}}, "duration": 0.0011748, "status": 502, "err_id": "5w2uyc3pw", "err_trace": "reverseproxy.statusError (reverseproxy.go:1390)"}

What's the expected result?

No 403 error in local https development

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-bn4gnrih?file=package.json

Participation

  • I am willing to submit a pull request for this issue.

Metadata

Metadata

Assignees

Labels

- P2: has workaroundAn edge case that only affects very specific usage, but has a trivial workaround (priority)6-betaIssues affects the beta of Astro 6pkg: astroRelated to the core `astro` package (scope)

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions