no-disabled-origin-check

Why it matters

Astro checks the Origin header for on-demand rendered pages to help prevent cross-site request forgery. Setting security.checkOrigin to false removes that protection from form submissions and other state-changing requests unless the application supplies an equivalent defense.

See the difference

import { defineConfig } from 'astro/config'

export default defineConfig({
  security: {
    checkOrigin: false,
  },
})

import { defineConfig } from 'astro/config'

export default defineConfig({
  security: {
    checkOrigin: true,
  },
})

Configure this check

Project audits are configured in doctor.config.ts:

export default {
  rules: {
    'astro-doctor/no-disabled-origin-check': 'error',
  },
}

Use 'error', 'warn', or 'off'. The configuration guide covers presets and per-file overrides.

Keep exploring security

• no-set-htmlAvoid set:html to prevent cross-site scripting (XSS) vulnerabilities.
• no-public-secret-envWarn when PUBLIC_ environment variables appear to contain secrets.
• no-insecure-session-cookieKeep secure, HTTP-only, same-site session cookie protections enabled.
• no-open-allowed-domainsConfigure explicit trusted host patterns instead of allowing every domain.
• require-action-input-schemaValidate untrusted Astro Action input before the handler runs.

Browse every rule and project audit