From 38e82f791eb191e979aed4e8631a2d1f087f46d0 Mon Sep 17 00:00:00 2001 From: metatroncubeswdev Date: Thu, 15 Oct 2026 05:06:05 -0400 Subject: [PATCH] fix: allow form actions from the app domain behind the HTTPS proxy React Router's CSRF check compared https Origin with the http URL seen behind Nginx, rejecting every admin form save with 400. Co-Authored-By: Claude Opus 5.5 --- react-router.config.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/react-router.config.ts b/react-router.config.ts index e45e273..821b238 100644 --- a/react-router.config.ts +++ b/react-router.config.ts @@ -2,4 +2,8 @@ import type { Config } from "@react-router/dev/config"; export default { ssr: true, + // Behind Nginx/Caddy the Node server sees http://, while the browser's Origin is https://, so + // React Router's CSRF check rejects every form action (400 Bad Request). List the hosts that may + // post: production, and the Shopify CLI dev tunnels. + allowedActionOrigins: ["datewise.metatronlabz.com", "*.trycloudflare.com"], } satisfies Config;