SvelteKit is removing csrf.checkOrigin — migrate cairn admin CSRF

[glw907]

Evidence

csrf.checkOrigin has been concretely removed in SvelteKit 3, currently in pre-release:

• Removal version: 3.0.0-next.15 via PR #15437
• Changelog entry (version-3 branch): "breaking: remove the deprecated CSRF checkOrigin option in favor of trustedOrigins (#15437)"
• Current next tag: 3.0.0-next.25 — the removal has already landed in active pre-releases
• Migration guide: Migrating to SvelteKit v3 documents that CSRF protection is always on in v3; trustedOrigins is the only remaining escape hatch
• Upstream tracking issue (glw907/cairn-cms's own filing, Deprecating csrf.checkOrigin removes the only way to fully disable the origin check, which trustedOrigins can't replace for missing-Origin requests sveltejs/kit#15992): closed
• Deprecation landed in: 2.36.2 (PR #14281), flagging this as a breaking change ahead

cairn's current usage

cairn depends on checkOrigin: false in svelte.config.js as a hard precondition for its admin CSRF subsystem. Key files:

File	Line	Role
src/lib/sveltekit/csrf.ts	1	Top-level comment: "cairn owns CSRF for the admin once a site disables SvelteKit's global checkOrigin"
src/lib/sveltekit/guard.ts	106	Comment: "they set checkOrigin: false to hand cairn the admin CSRF authority"
src/lib/doctor/checks-local.ts	67, 74, 104, 112	Doctor check that asserts checkOrigin: false is present in svelte.config.js or vite.config.ts
src/tests/unit/doctor-checks-local.test.ts	58, 318, 329	Unit tests for the above doctor check

Current peer/dev range: ^2.70 (stable 2.70.3).

Impact

When consumer sites upgrade to SvelteKit 3, csrf: { checkOrigin: false } will be silently ignored or will fail to compile, breaking all admin POST flows. The doctor check will also fire on a setting that no longer exists.

trustedOrigins cannot replace checkOrigin: false for cairn's case: the !request_origin clause in SvelteKit's CSRF guard forbids missing-Origin POSTs regardless of trustedOrigins, and privacy-hardened browsers routinely omit the Origin header on same-site navigations.

Planned fallback

The planned migration path (documented in ROADMAP.md under "Migrate cairn's CSRF-disable before SvelteKit removes checkOrigin" and docs/cairn-dx-feedback-2026-06-09-907-0.36-retrofit.md) is:

A Cloudflare Transform Rule that injects an Origin header for /admin POSTs at the edge, before SvelteKit's CSRF guard runs. This lets cairn configure trustedOrigins: ['self'] (or the site's own origin) instead of disabling the check globally, and means the guard always sees an Origin it can evaluate.

The higher-leverage path remains getting upstream to provide a hook that runs before the CSRF check (so cairn can short-circuit it for requests it has already validated), but the Transform Rule is the pragmatic zero-new-dependency fallback.

What needs to happen before SvelteKit 3 stable ships

• Implement the Cloudflare Transform Rule approach and document it for consumer sites
• Remove the checkOrigin: false doctor check (or convert it to flag the old pattern as deprecated)
• Update the getting-started scaffold so new sites use trustedOrigins instead of checkOrigin: false
• Update docs/guides/restrict-admin-access.md and any other docs referencing checkOrigin
• Close the ROADMAP watch item