# Security: Stronger Protection Against Cross-Site Requests

Published 2026-11-01

> Staff actions now check the request’s origin before accepting cookie-based authentication.

Requests that change data using a staff sign-in cookie now require an allowed origin. Requests from the same site, configured allowed origins, or the tenant’s active custom domain can pass the check.

This closes a gap where an unrelated website could submit a request using the browser’s existing staff cookie. Self-hosted installations with a frontend on a separate domain must include it in their allowed-domain configuration.

Available in erxes v3.4.7, released October 29, 2026.