## The problem
My Astro SSR site hosted through an Appwrite custom domain worked fine on YOUR_HOST, but Astro's CSRF and origin validation rejected every POST form submission once served through the custom domain. The browser showed Cross-site POST form submissions are forbidden. The thread is from September 2026 and a maintainer verified the fix on a production Appwrite Cloud test site with the reporter's exact versions.
## What fixed it
Astro's checkOrigin blocks POSTs when the served hostname isnt in its allowlist, which is exactly what happens behind an Appwrite custom domain. The fix: put the exact HTTPS hostname into Astro's security.allowedDomains and keep checkOrigin enabled. The maintainer verified this on a production test site with Astro 7.3.3 and @astrojs/node 11.1.6, and the browser form submission succeeded. YOUR_HOST works because its already trusted, so this only bites on the custom domain.