Skip to content
astro-doctor
Securitywarn by defaultrecommended presetastro-doctor/no-disabled-origin-check

no-disabled-origin-check

Keep Astro's built-in CSRF origin check enabled.

Why

Astro checks the Origin header for on-demand rendered pages to help prevent cross-site request forgery. Setting security.checkOrigin to false removes that protection from form submissions and other state-changing requests unless the application supplies an equivalent defense.

Examples

Incorrect

Origin checking disabled

typescript
import { defineConfig } from 'astro/config'

export default defineConfig({
  security: {
    checkOrigin: false,
  },
})

Correct

Use Astro's secure default

typescript
import { defineConfig } from 'astro/config'

export default defineConfig({
  security: {
    checkOrigin: true,
  },
})

Configuration

Project audits are configured in doctor.config.ts:

typescriptdoctor.config.ts
export default {
            rules: {
              'astro-doctor/no-disabled-origin-check': 'error', // or 'warn' or 'off'
            },
          }

All rules

Edit this page on GitHub ↗