X_CSRF_BLOCKED

an unsafe request that did not prove same-origin

a state-changing request a browser sent — carrying its ambient session cookie, or anonymously (a forged sign-in) — whose Origin is not one this app allows. Never a 401: who is calling was never the question. An anonymous request carrying neither Origin nor sec-fetch-site is not judged

from a loopback client, the curl -H 'sec-fetch-site: same-origin' line it prints, with the request's own origin and path. Otherwise call it with an Authorization: Bearer token instead of the session cookie, add the calling origin to configureHttp({ cors: { origins } }), or configureHttp({ csrf: { mode: 'off' } }) if this app has no cookie session at all