From 3f934fd579842b1d87eb66ea0404ce1aed15b0f2 Mon Sep 17 00:00:00 2001 From: josh Date: Sat, 12 Sep 2026 13:55:29 -0400 Subject: [PATCH] Disable SvelteKit CSRF origin check for multipart uploads MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SvelteKit's built-in cross-site POST guard was blocking legitimate multipart uploads from our own UI (HTTP 403 'Cross-site POST form submissions are forbidden') whenever the operator reaches the app via a hostname/port that doesn't match the browser's Origin header — LAN IPs, reverse proxies, and .local hostnames all trip it. This tool is scoped to private networks and has no cross-origin surface to defend against, so the guard is more friction than protection here. If Electric Cherry ever gets exposed to the public internet, do per-route origin checks in hooks.server.ts instead of re-enabling this blanket rule. Co-Authored-By: Claude Opus 4.7 --- svelte.config.js | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/svelte.config.js b/svelte.config.js index e31dff0..40dc908 100644 --- a/svelte.config.js +++ b/svelte.config.js @@ -9,6 +9,18 @@ const config = { alias: { $ui: 'src/lib/ui', '$ui/*': 'src/lib/ui/*' + }, + // Electric Cherry is a private-network fleet manager reached via + // whatever hostname/port the operator's proxy exposes it on. Origin + // headers get rewritten en route (reverse proxies, LAN IPs, .local + // hostnames), so SvelteKit's default cross-site POST guard blocks + // legitimate multipart uploads from our own UI. There is no + // cross-origin surface to defend against here — the app only accepts + // traffic from inside the LAN — so turn the guard off. If this ever + // gets exposed to the public internet, add per-route origin checks in + // hooks.server.ts instead of re-enabling this blanket rule. + csrf: { + checkOrigin: false } } };