joshandClaude Opus 4.7
3f934fd579
SvelteKit's built-in cross-site POST guard was blocking legitimate multipart uploads from our own UI (HTTP 403 'Cross-site POST form submissions are forbidden') whenever the operator reaches the app via a hostname/port that doesn't match the browser's Origin header — LAN IPs, reverse proxies, and .local hostnames all trip it. This tool is scoped to private networks and has no cross-origin surface to defend against, so the guard is more friction than protection here. If Electric Cherry ever gets exposed to the public internet, do per-route origin checks in hooks.server.ts instead of re-enabling this blanket rule. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
29 lines
1.1 KiB
JavaScript
29 lines
1.1 KiB
JavaScript
import adapter from '@sveltejs/adapter-node';
|
|
import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
|
|
|
|
/** @type {import('@sveltejs/kit').Config} */
|
|
const config = {
|
|
preprocess: vitePreprocess(),
|
|
kit: {
|
|
adapter: adapter({ out: 'build' }),
|
|
alias: {
|
|
$ui: 'src/lib/ui',
|
|
'$ui/*': 'src/lib/ui/*'
|
|
},
|
|
// Electric Cherry is a private-network fleet manager reached via
|
|
// whatever hostname/port the operator's proxy exposes it on. Origin
|
|
// headers get rewritten en route (reverse proxies, LAN IPs, .local
|
|
// hostnames), so SvelteKit's default cross-site POST guard blocks
|
|
// legitimate multipart uploads from our own UI. There is no
|
|
// cross-origin surface to defend against here — the app only accepts
|
|
// traffic from inside the LAN — so turn the guard off. If this ever
|
|
// gets exposed to the public internet, add per-route origin checks in
|
|
// hooks.server.ts instead of re-enabling this blanket rule.
|
|
csrf: {
|
|
checkOrigin: false
|
|
}
|
|
}
|
|
};
|
|
|
|
export default config;
|