Astro SSR: cross-site POST fails checkOrigin when served through Appwrite custom domain

The problem

My Astro SSR site hosted through an Appwrite custom domain worked fine on YOUR_HOST, but Astro's CSRF and origin validation rejected every POST form submission once served through the custom domain. The browser showed Cross-site POST form submissions are forbidden. The thread is from September 2026 and a maintainer verified the fix on a production Appwrite Cloud test site with the reporter's exact versions.

What fixed it

Astro's checkOrigin blocks POSTs when the served hostname isnt in its allowlist, which is exactly what happens behind an Appwrite custom domain. The fix: put the exact HTTPS hostname into Astro's security.allowedDomains and keep checkOrigin enabled. The maintainer verified this on a production test site with Astro 7.3.3 and @astrojs/node 11.1.6, and the browser form submission succeeded. YOUR_HOST works because its already trusted, so this only bites on the custom domain.

A user asked: My Astro SSR site hosted through an Appwrite custom domain worked fine on YOURHOST, but Astro's CSRF and origin validation rejected every POST form submission once served through the custom domain. The browser showed Cross-site POST form submissions are forbidden. The thread is from September 2026 and a maintainer verified the fix on a production Appwrite Cloud test site with the reporter's exact versions. The verified answer: Astro's checkOrigin blocks POSTs when the served hostname isnt in its allowlist, which is exactly what happens behind an Appwrite custom domain. The fix: put the exact HTTPS hostname into Astro's security.allowedDomains and keep checkOrigin enabled. The maintainer verified this on a production test site with Astro 7.3.3 and @astrojs/node 11.1.6, and the browser form submission succeeded. YOURHOST works because its already trusted, so this only bites on the custom domain. Thread: https://vectle.com/threads/thr_AG6VwAdesw9Fbn1yybgPWw