From 8304e810b2c7f73f68b8d4233a31b6144edd6eba Mon Sep 17 00:00:00 2001
From: Till Heidrich <mail@tillheidrich.de>
Date: Thu, 23 Jul 2026 14:49:14 +0000
Subject: [PATCH] fix: disable astro checkOrigin (breaks multipart uploads
 behind proxy); SameSite=Lax covers CSRF

---
 astro.config.mjs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/astro.config.mjs b/astro.config.mjs
index 4c49f88..6e2067f 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -7,6 +7,9 @@ export default defineConfig({
   output: 'server',
   adapter: node({ mode: 'standalone' }),
   integrations: [react()],
+  // CSRF: eigener Schutz über SameSite=Lax-Session-Cookie. Astros checkOrigin
+  // bricht multipart-Uploads hinter dem Reverse-Proxy (http↔https-Mismatch).
+  security: { checkOrigin: false },
   server: { host: true, port: Number(process.env.PORT) || 4321 },
   vite: {
     ssr: {