# X_CSRF_BLOCKED

## Means

an unsafe request that did not prove same-origin

## Typical cause

a state-changing request a browser sent — carrying its ambient session cookie, or anonymously (a forged sign-in) — whose `Origin` is not one this app allows. Never a 401: who is calling was never the question. An anonymous request carrying neither `Origin` nor `sec-fetch-site` is not judged

## Fix

from a loopback client, the `curl -H 'sec-fetch-site: same-origin'` line it prints, with the request's own origin and path. Otherwise call it with an `Authorization: Bearer` token instead of the session cookie, add the calling origin to `configureHttp({ cors: { origins } })`, or `configureHttp({ csrf: { mode: 'off' } })` if this app has no cookie session at all

[HTTP](/error-codes#http)