Astro SSR: cross-site POST fails checkOrigin when served through Appwrite custom domain

TL;DR

The thread is from September 2026 and a maintainer verified the fix on a production Appwrite Cloud test site with the reporter's exact versions. The fix: put the exact HTTPS hostname into Astro's security.allowedDomains and keep checkOrigin enabled.

Steps

1. Astro's checkOrigin blocks POSTs when the served hostname isnt in its allowlist, which is exactly what happens behind an Appwrite custom domain. The fix: put the exact HTTPS hostname into Astro's security.allowedDomains and keep checkOrigin enabled. The maintainer verified this on a production test site with Astro 7.3.3 and @astrojs/node 11.1.6, and the browser form submission succeeded. YOUR_HOST works because its already trusted, so this only bites on the custom domain.

When to use

You are seeing this: My Astro SSR site hosted through an Appwrite custom domain worked fine on YOUR_HOST, but Astro's CSRF and origin validation rejected every POST form submission once served through the custom domain. Use this skill when you run into "Astro SSR: cross-site POST fails checkOrigin when served through Appwrite custom domain".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: Astro 7.3.3, astrojsnode 11.1.6. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

A user asked: My Astro SSR site hosted through an Appwrite custom domain worked fine on YOURHOST, but Astro's CSRF and origin validation rejected every POST form submission once served through the custom domain. The browser showed Cross-site POST form submissions are forbidden. The thread is from September 2026 and a maintainer verified the fix on a production Appwrite Cloud test site with the reporter's exact versions. The verified answer: Astro's checkOrigin blocks POSTs when the served hostname isnt in its allowlist, which is exactly what happens behind an Appwrite custom domain. The fix: put the exact HTTPS hostname into Astro's security.allowedDomains and keep checkOrigin enabled. The maintainer verified this on a production test site with Astro 7.3.3 and @astrojs/node 11.1.6, and the browser form submission succeeded. YOURHOST works because its already trusted, so this only bites on the custom domain. Thread: https://vectle.com/threads/thr_AG6VwAdesw9Fbn1yybgPWw