-
-
Notifications
You must be signed in to change notification settings - Fork 3.5k
checkOrigin in v6.0.0-beta.14 #15587
Copy link
Copy link
Closed
Labels
- P2: has workaroundAn edge case that only affects very specific usage, but has a trivial workaround (priority)An edge case that only affects very specific usage, but has a trivial workaround (priority)6-betaIssues affects the beta of Astro 6Issues affects the beta of Astro 6pkg: astroRelated to the core `astro` package (scope)Related to the core `astro` package (scope)
Metadata
Metadata
Assignees
Labels
- P2: has workaroundAn edge case that only affects very specific usage, but has a trivial workaround (priority)An edge case that only affects very specific usage, but has a trivial workaround (priority)6-betaIssues affects the beta of Astro 6Issues affects the beta of Astro 6pkg: astroRelated to the core `astro` package (scope)Related to the core `astro` package (scope)
Type
Fields
Give feedbackNo fields configured for issues without a type.
Astro Info
If this issue only occurs in one browser, which browser is a problem?
No response
Describe the Bug
I encountered this on a local machine immediately after upgrading from 5.17.1 to 6.0.0-beta.14. I get errors in actions
Cross-site POST form submissions are forbiddencheckOrigin: falsesolves this problem,I am using caddy server before astro for https availability in development
Here are his logs
2026/02/20 06:27:38.690 ERROR http.log.error dial tcp [::1]:3001: connectex: No connection could be made because the target machine actively refused it. {"request": {"remote_ip": "::1", "remote_port": "64129", "client_ip": "::1", "proto": "HTTP/1.1", "method": "GET", "host": "my.test.localhost", "uri": "/", "headers": {"Sec-Websocket-Extensions": ["permessage-deflate; client_max_window_bits"], "Cache-Control": ["no-cache"], "User-Agent": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36"], "Origin": ["https://my.test.localhost"], "Sec-Websocket-Protocol": ["vite-ping"], "Connection": ["Upgrade"], "Pragma": ["no-cache"], "Upgrade": ["websocket"], "Sec-Websocket-Version": ["13"], "Accept-Language": ["ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7"], "Cookie": ["REDACTED"], "Accept-Encoding": ["gzip, deflate, br, zstd"], "Sec-Websocket-Key": ["lgHdA5gGi11nrea53cA58g=="]}, "tls": {"resumed": true, "version": 772, "cipher_suite": 4865, "proto": "http/1.1", "server_name": "my.test.localhost"}}, "duration": 0.0011748, "status": 502, "err_id": "5w2uyc3pw", "err_trace": "reverseproxy.statusError (reverseproxy.go:1390)"}What's the expected result?
No 403 error in local https development
Link to Minimal Reproducible Example
https://stackblitz.com/edit/github-bn4gnrih?file=package.json
Participation