Block cross-site form POSTs by default

documentation/docs/14-configuration.md

@@ -168,9 +168,9 @@ When pages are prerendered, the CSP header is added via a `<meta http-equiv>` ta
 
 Protection against [cross-site request forgery](https://owasp.org/www-community/attacks/csrf) attacks:
 
-- `checkOrigin` — if `true`, SvelteKit will check the incoming `origin` header for `POST` requests and verify that it matches the server's origin
+- `checkOrigin` — if `true`, SvelteKit will check the incoming `origin` header for `POST` form submissions and verify that it matches the server's origin
 
-To allow people to make `POST` requests to your app from other origins, you will need to disable this option. Be careful!
+To allow people to make `POST` form submissions to your app from other origins, you will need to disable this option. Be careful!
 
 ### env
 

packages/kit/src/runtime/server/index.js

@@ -18,12 +18,19 @@ const default_transform = ({ html }) => html;
 export async function respond(request, options, state) {
 	let url = new URL(request.url);
 
-	if (
-		options.csrf.check_origin &&
-		request.method === 'POST' &&
-		request.headers.get('origin') !== url.origin
-	) {
-		return new Response(`Cross-site ${request.method} requests are forbidden`, { status: 403 });
+	if (options.csrf.check_origin) {
+		const type = request.headers.get('content-type');
+
+		const forbidden =
+			request.method === 'POST' &&
+			request.headers.get('origin') !== url.origin &&
+			(type === 'application/x-www-form-urlencoded' || type === 'multipart/form-data');
+
+		if (forbidden) {
+			return new Response(`Cross-site ${request.method} form submissions are forbidden`, {
+				status: 403
+			});
+		}
 	}
 
 	const { parameter, allowed } = options.method_override;

packages/kit/test/apps/basics/test/server.test.js

@@ -30,7 +30,7 @@ test.describe('CSRF', () => {
 		});
 
 		expect(res.status).toBe(403);
-		expect(await res.text()).toBe('Cross-site POST requests are forbidden');
+		expect(await res.text()).toBe('Cross-site POST form submissions are forbidden');
 	});
 });