Skip CSRF host checks in non-prod (reverse proxy friendly)

web/src/index.js

@@ -85,6 +85,11 @@ app.use(express.json());
 // Basic CSRF mitigation: require same-origin POSTs
 app.use((req, res, next) => {
   if (req.method !== 'POST') return next();
+
+  // MVP/dev: skip CSRF host checks entirely (reverse proxies + browser privacy features
+  // can omit/alter Origin/Referer and cause false blocks). Enforce in production.
+  if (!isProd) return next();
+
   // Allow OAuth callbacks (they are GET in our app anyway) and health checks
   const origin = req.get('origin');
   const referer = req.get('referer');
@@ -103,6 +108,10 @@ app.use((req, res, next) => {
   // Some clients omit Origin; allow Referer as fallback.
   if ((origin && ok(origin)) || (!origin && referer && ok(referer))) return next();
 
+  // In non-production MVP/dev environments, be permissive if headers are missing.
+  // (Notably some browsers/proxies can omit Origin/Referer on same-origin form posts.)
+  if (!isProd && !origin && !referer) return next();
+
   return res.status(403).send('Blocked (CSRF)');
 });