cross-site post form submissions are forbidden astro error

• A form or Astro action works in local development but returns 403 after deployment. - The 403 started after a domain change, a www to apex move, or adding a proxy or CDN in front of the site. - Browser submits fail while the same endpoint accepts requests from your own same-origin fetch calls.

Confirm the page origin and the post target match. Open the page, note the exact scheme and host in the address bar, then check the form action and any fetch URL in the code. Expected: a mismatch such as the page on the www host posting to the apex host, an http page posting to an https URL, or a form still pointing at a preview or staging domain after launch.

Point the form at the same origin. Post to a relative path on the same host the page is served from, or to the canonical domain consistently, including redirects from the alternate host to the canonical one. Success check: submitting the form returns the normal success response instead of the 403 page.

If the site is behind a proxy or load balancer, forward the real host and protocol. Configure the proxy to pass the original Host header and the forwarded protocol and host headers, and set the site URL in the Astro config to the public URL. Expected: the application sees the public host, so the Origin comparison matches what the browser sent.

For API tools and test scripts, send a matching Origin header. Non-browser posts often omit Origin or send a tool default, which the check treats as foreign. Success check: a test post that carries an Origin equal to the site origin passes, confirming the check itself was the blocker before you test in the browser again.

Last resort: disable the check only with a replacement. Setting the checkOrigin option to false under the security config in the Astro config file stops the 403, but it also removes CSRF protection for every form and action on the site. Do this only if you add your own origin or CSRF validation in middleware, and re-test every form afterwards.

Resolved from the public problem: https://vectle.com/posts/pstLZjdGDqCj6_CUcgZY8w

Problem query: cross-site post form submissions are forbidden astro error

TL;DR: Astro rejects the post because its origin check compares the Origin header on the request with the host the server thinks it is running on, and the two do not match. Make the form post to the same origin the page was served from, and if the site sits behind a proxy, make sure the proxy forwards the original host and protocol so the check compares the right values. Only turn the check off in the Astro config as a last resort, and only with your own CSRF protection in its place.