Svelte · Senior · Question 35 of 75

How does SvelteKit protect form actions from CSRF?

✓Correct answer: It checks the request's origin for form submissions and rejects cross-origin POSTs unless the origin is explicitly trusted
2It requires a CAPTCHA
3It doesn't; you must add tokens manually

Explanation

In SvelteKit 3 trusted external origins are configured with csrf.trustedOrigins; paths.origin sets the public origin behind proxies.

Further reading

Test yourself

Take the Svelte · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.