Cross-site POST form submissions are forbidden

[asoltys]

Describe the bug

I'm getting an error message about a cross-site request when submitting a form to a relative URL that's handled by an endpoint on the same server.

The error only occurs when running the production build with the node-adapter, not with the dev server.

Reproduction

https://github.com/asoltys/svelte-cross-site-repro

Logs

Cross-site POST form submissions are forbidden

System Info

System:
    OS: Linux 5.19 Pop!_OS 22.04 LTS
    CPU: (12) x64 Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz
    Memory: 4.55 GB / 15.35 GB
    Container: Yes
    Shell: 5.1.16 - /bin/bash
  Binaries:
    Node: 18.7.0 - ~/.local/share/pnpm/node
    npm: 8.15.0 - ~/.local/share/pnpm/npm
  Browsers:
    Chrome: 104.0.5112.101
    Firefox: 103.0
  npmPackages:
    @sveltejs/adapter-auto: next => 1.0.0-next.71 
    @sveltejs/adapter-node: 1.0.0-next.88 => 1.0.0-next.88 
    @sveltejs/kit: next => 1.0.0-next.470 
    svelte: ^3.44.0 => 3.50.0 
    vite: ^3.1.0 => 3.1.0

Severity

serious, but I can work around it

Additional Information

No response

[Conduitry]

How are you running the server? I would bet the issue is that you're not using https://github.com/sveltejs/kit/tree/master/packages/adapter-node#environment-variables to tell the server what origin it's serving from. Note that in particular in production the Node adapter will assume by default that it has an HTTPS proxy in front of it and that its origin is https://[host header], not http://[host header].

[asoltys]

Thanks, I did have it behind an https proxy but something must have been off because setting the ORIGIN env var explicitly helped.

[xpluscal]

So how is the ORIGIN env var being pulled in?
Does it have to be present at build and or runtime?
From the docs it says running this during build, but still having it not taking effect in the live build on the site.

Any help appreciated.

[kyllerss]

Same issue here.

[nevermindthelabel]

@kyllerss @xpluscal what I have done that has been working is in your run command (this is from my Dockerfile) CMD ORIGIN=https://whateverYourProdDomain node build

[kyllerss]

@nevermindthelabel I'm not familiar w/ the node build command. Are you building it into your docker image? In my case, I have mounted a local directory to my docker image. I'm using vite build to generate the build. Then the command I'm using to run it is vite preview --host.

I've tried prefixing both the build step and the execution step w/ the environment variable but no luck. Does the env variable need to be part of the build to be compiled into the output? Does vite build do something to prevent the env variable from being passed through to the underlying build step?

[nevermindthelabel]

@nevermindthelabel I'm not familiar w/ the node build command. Are you building it into your docker image? In my case, I have mounted a local directory to my docker image. I'm using vite build to generate the build. Then the command I'm using to run it is vite preview --host.

I've tried prefixing both the build step and the execution step w/ the environment variable but no luck. Does the env variable need to be part of the build to be compiled into the output? Does vite build do something to prevent the env variable from being passed through to the underlying build step?

I should also say that I am using adapter-node. That builds the build directory, so under the hood it is running node build/index.js.

You need to pass the origin as an argument at runtime, and if you are doing it from docker you might need to do -e origin=http://localhost:port or wherever the sveltekit app is running.

[Bishwas-py]

Cross-site POST form submissions are forbidden

Use @sveltejs/adapter-node adapter, and pass ORIGIN=https://yoursite.com environment variable while deploying/building it. Here's a proper solution for it.

[na2axl]

Can someone please know how to handle this if the app is served from multiple origins (subdomains like *.mysite.com) ?

[bitdom8]

Same here, demand to use import adapter from '@sveltejs/adapter-auto'; since it builds half of the size