Same-Origin Proxy

Browser ──/cms/*──▶ Astro server ──server-side request──▶ Kenresoft API Worker

The browser calls https://your-site.com/cms/*. Your Astro server forwards the request to the CMS API, so the session cookie belongs to your site. This is the recommended setup for any site with accounts.

The CLI creates the proxy for you at src/pages/cms/[...path].ts (see Existing Astro site). It is built on createCmsProxy() from @kenresoft-cms/astro and forwards only an allow-list of public, auth and plugin-public paths. The CMS admin API is not exposed through it.

The proxy needs on-demand (server) rendering and a deployment adapter.

Preserve visitor IPs for rate limiting

Behind the proxy, the API sees your Astro Worker as the client. To keep per-visitor rate limits accurate, set the same secret on both sides:

wrangler secret put TRUSTED_PROXY_SECRET   # in the CMS

Give the same value to the proxy as a server-side variable. Never expose it through a PUBLIC_ variable.

Direct mode

The browser can call the API directly (Browser → CMS API). It is simpler but depends on cross-site cookie behavior for authentication, and some browsers block those cookies.