“Cross-site POST form submissions are forbidden”: SvelteKit got the wrong origin.

The response is a plain-text 403 with the body Cross-site POST form submissions are forbidden (the method name changes for PUT, PATCH or DELETE; a request that accepts JSON gets {"message": …}). It comes from SvelteKit’s CSRF protection, which only runs in production builds. That is why it never shows up under vite dev.

With @sveltejs/adapter-node, the origin SvelteKit compares against is built like this:

// What the check compares (production builds only, not vite dev)
self origin = paths.origin (SvelteKit 3)  or  ORIGIN (adapter-node 5)
            or else  <PROTOCOL_HEADER value, or "https"> :// <HOST_HEADER value, or Host>

browser sends  Origin: https://shop.example.com

no match on a POST, PUT, PATCH or DELETE form  ->  403
  Cross-site POST form submissions are forbidden

When no origin is configured, adapter-node can read the scheme and host from proxy headers: PROTOCOL_HEADER=x-forwarded-proto and HOST_HEADER=x-forwarded-host (and PORT_HEADER=x-forwarded-port if the public port isn’t the default). The SvelteKit docs are explicit: set these only behind a trusted reverse proxy, because a client can otherwise send them itself.

These are runtime variables, read when the server starts. paths.origin in SvelteKit 3 is config, baked in at build time, and it holds one origin for every host the app answers on.

• How it runs. Canner detects SvelteKit and starts node ./build/index.js, the adapter-node server. Without adapter-node the build stops with SvelteKit build did not produce build/index.js — install @sveltejs/adapter-node and set it as the adapter in your SvelteKit config (svelte.config.js, or vite.config.js on SvelteKit 3). @sveltejs/adapter-vercel, -netlify and -cloudflare are refused at detection, with a message naming adapter-node.
• What the proxy sends. Requests reach your app through Caddy, which terminates HTTPS, passes the Host header unchanged and sets X-Forwarded-Proto, X-Forwarded-For and X-Forwarded-Host. By default, Caddy discards any X-Forwarded-* values a client sends and writes its own.
• So the defaults work. With no ORIGIN and no paths.origin, adapter-node builds https:// plus the host the visitor typed. That matches on <slug>.canner.app, on each custom domain and on preview URLs, all at once. The optional caching proxy keeps Host too.
• Don’t set ORIGIN from `CANNER_URL`. CANNER_URL is the deploy’s canner.app address (or the preview’s), so visitors on your custom domain would get the 403. The same goes for paths.origin.
• Want it explicit? PROTOCOL_HEADER=x-forwarded-proto and HOST_HEADER=x-forwarded-host read the values Caddy writes, so they give the same result. Set them under environment variables and redeploy. You don’t need them.
• Node version. SvelteKit 3 needs Node 22.17 or later. Canner compares only major versions, so pick Node 24 in the project settings to be sure. See pin the Node.js version.

The old fix, csrf: { checkOrigin: false }, is gone in SvelteKit 3: the build fails, saying checkOrigin has been removed in favour of csrf.trustedOrigins. Its replacement, trustedOrigins: ['*'], turns the protection off for every site, which the SvelteKit docs advise against. Your form actions then accept a POST from any page on the internet that a logged-in user visits.

When an outside site really does post to you, list that one origin:

// vite.config.js (SvelteKit 3)
import adapter from '@sveltejs/adapter-node';
import { sveltekit } from '@sveltejs/kit/vite';
import { defineConfig } from 'vite';

export default defineConfig({
  plugins: [
    sveltekit({
      adapter: adapter(),
      // Only origins that legitimately post forms to you, such as a payment page
      csrf: { trustedOrigins: ['https://checkout.example-payments.com'] }
    })
  ]
});