From 7091fab790cb84de90df2e37e260b57d67cf1350 Mon Sep 17 00:00:00 2001 From: Thomas Boutell Date: Wed, 5 Nov 2025 11:57:12 -0500 Subject: [PATCH 1/3] PRO-8571: fix the astro section template library bug introduced in astro 4.9.0 --- CHANGELOG.md | 2 ++ modules/@apostrophecms/area/index.js | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6b41101576..43a9ba5d50 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,8 @@ ### Fixes +* Specify the content type when calling back to Astro with JSON to render an area. This is required starting in Astro 4.9.0 and up, otherwise the request is blocked by CSRF protection. + ## 4.23.0 (2025-10-30) ### Adds diff --git a/modules/@apostrophecms/area/index.js b/modules/@apostrophecms/area/index.js index e72695a6f7..d656f3bb97 100644 --- a/modules/@apostrophecms/area/index.js +++ b/modules/@apostrophecms/area/index.js @@ -376,7 +376,9 @@ module.exports = { const response = await fetch(`${self.apos.baseUrl}/api/apos-external-front/render-area`, { method: 'POST', headers: { - 'apos-external-front-key': self.apos.externalFrontKey + 'apos-external-front-key': self.apos.externalFrontKey, + // Without this Astro enforces CSRF protection starting in version 5.9.0 + 'content-type': 'application-json' }, body: JSON.stringify({ area From e6ff5c6e38523125953b37070113781fea836d7d Mon Sep 17 00:00:00 2001 From: Thomas Boutell Date: Wed, 5 Nov 2025 11:58:13 -0500 Subject: [PATCH 2/3] version number correct --- modules/@apostrophecms/area/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/@apostrophecms/area/index.js b/modules/@apostrophecms/area/index.js index d656f3bb97..f4299bb0a7 100644 --- a/modules/@apostrophecms/area/index.js +++ b/modules/@apostrophecms/area/index.js @@ -377,7 +377,7 @@ module.exports = { method: 'POST', headers: { 'apos-external-front-key': self.apos.externalFrontKey, - // Without this Astro enforces CSRF protection starting in version 5.9.0 + // Without this Astro enforces CSRF protection starting in version 4.9.0 'content-type': 'application-json' }, body: JSON.stringify({ From 89bdd632568dda3c754815fedb518c94e991580b Mon Sep 17 00:00:00 2001 From: Thomas Boutell Date: Thu, 6 Nov 2025 09:53:42 -0500 Subject: [PATCH 3/3] bad typo --- modules/@apostrophecms/area/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/@apostrophecms/area/index.js b/modules/@apostrophecms/area/index.js index f4299bb0a7..ca10c429bc 100644 --- a/modules/@apostrophecms/area/index.js +++ b/modules/@apostrophecms/area/index.js @@ -378,7 +378,7 @@ module.exports = { headers: { 'apos-external-front-key': self.apos.externalFrontKey, // Without this Astro enforces CSRF protection starting in version 4.9.0 - 'content-type': 'application-json' + 'content-type': 'application/json' }, body: JSON.stringify({ area