@mrowand The whole point of the checkAuthAndCSRF is to prevent unauthorized access. Based on the message I’m seeing, the 403 forbidden is happening because it’s crossing origin to get the data or the CSRF token isn’t passing correctly:
Here’s the code that validates:
// Optional defense-in-depth: Origin/Referer check for state-changing requests
public static function checkOrigin(array $allowedOrigins): void
{
$method = strtoupper($_SERVER['REQUEST_METHOD'] ?? 'GET');
if (!in_array($method, ['POST','PUT','PATCH','DELETE'], true)) {
return;
}
$origin = $_SERVER['HTTP_ORIGIN'] ?? null;
$referer = $_SERVER['HTTP_REFERER'] ?? null;
if ($origin) {
foreach ($allowedOrigins as $allowed) {
if (stripos($origin, $allowed) === 0) {
return;
}
}
http_response_code(403);
echo _('Forbidden (disallowed Origin)');
exit;
} elseif ($referer) {
foreach ($allowedOrigins as $allowed) {
if (stripos($referer, $allowed) === 0) {
return;
}
}
http_response_code(403);
echo _('Forbidden (disallowed Referer)');
exit;
}
// If neither header is present, you can decide to be strict or lenient.
// Often lenient to avoid breaking weird client setups.
}
I suspect your console has more information leading to the specific error that was hit.
ultimately the code is working as expected and there’s something in your environment causing the issue. Now, to be fair, you said you installed Stable, and Dev-branch has a fix of which I admit I missed.
If you’re willing/able to install the dev-branch I suspect you’ll see this is working much better.
