Fix Origin Check Bypass in Astro Actions and On-Demand Endpoints

Vulnerability Overview This vulnerability concerns the application of origin checks within Astro Actions. Specifically, the origin check is now enforced at the request distribution points (Astro Actions and On-Demand Endpoints/Pages) to ensure consistent execution regardless of the order in which the composable Astro/Hono pipeline is configured. Previously, the origin check was only executed inside , meaning it could be subject to the original order of middleware or skipped entirely if was omitted. Impact Scope Affected Components: Astro Actions and On-Demand Endpoints/Pages. Affected Behavior: Origin checks may not have been correctly applied in all scenarios, leading to potential security issues. Remediation 1. Extract Shared Logic: The shared origin check logic has been extracted to . This file contains a predicate and a response builder, which are consumed by pipeline middleware, action dispatchers, and page endpoint dispatchers. 2. Maintain Consistent Behavior: In the classic pipeline, the origin check remains a no-op at the dispatch point if middleware has already run. Similarly, for pre-rendered/static routes, it remains a no-op if is disabled. 3. Testing: - Added : Composes a Hono app with placed before , asserting that cross-origin action requests are rejected before the handler runs, while same-origin requests succeed. - Added : Composes a Hono app with and no , asserting that cross-origin POST requests are rejected at on-demand endpoints before the handler runs, while same-origin requests succeed. 4. Documentation: No documentation updates are required, as the behavior remains unchanged from the user's perspective. POC Code Summary This fix ensures that origin checks are correctly applied in all scenarios, thereby enhancing the security of Astro Actions and On-Demand Endpoints/Pages.

Goal Reached Thanks to every supporter — we hit 100%!

Fix Origin Check Bypass in Astro Actions and On-Demand Endpoints

More from this source