CandleStack
← All problem types

Cross-origin request

A request that changes your account came from somewhere other than the CandleStack app.

Details

  • Status403 Forbidden
  • Typehttps://candlestack.tech/problems/cross-origin-request

When it happens

  • A state-changing request, like POST /api/v1/auth/sign-out, has an Origin header that is not the app's own origin.
  • There is no Origin header and the browser does not say the request is same-origin.

What to do

  1. 1Open the app at its own address and do the action there.
  2. 2Do not call these routes from another site or from a script on a different origin.