Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Summary

In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware() primitive. The actions() and pages() primitives each dispatch to user code independently, so a pipeline that mounts either primitive before (or without) middleware() will bypass the origin check for those requests.

Details

security.checkOrigin (default: true) is intended to reject cross-site POST/PUT/PATCH/DELETE form submissions. In the classic pipeline (astro() all-in-one), the check always runs because Astro injects a virtual middleware module even when the user has no src/middleware.ts. In the composable astro/hono pipeline, the user assembles primitives manually. The check is only installed inside middleware() — so:

• Mounting actions() before middleware() allows cross-origin form-encoded action requests to execute before the gate runs. The examples/advanced-routing example and the Cloudflare hono docs shipped this order.
• Omitting middleware() entirely (reasonable for apps with no custom middleware) silently drops checkOrigin protection for all on-demand endpoints and pages dispatched through pages().

The attack is a blind write-only CSRF: the attacker can trigger a state-mutating action or endpoint handler using the victim's cookies, but cannot read the cross-origin response body.

Affected versions

Astro >= 7.0.0 when using the composable astro/hono pipeline with either:

• actions() mounted before middleware(), or
• pages() used without middleware()

The default (non-composable) pipeline is not affected.

Fix

The origin check is now applied at each dispatch sink ( and ), gated on , using the same predicate as the middleware. The check is order-independent and a no-op when has already run.