Cross-site remote requests forbidden error when using remote functions in production deployment

Describe the bug

Issue Summary

I'm encountering a 403 error with the message "Cross-site remote requests are forbidden" when using SvelteKit's remote functions feature in a production deployment. The remote function works correctly in development but fails when deployed to Railway.

Environment

• SvelteKit version: 2.37.0
• Svelte version: 5.38.6
• Deployment platform: Railway
• Adapter: @sveltejs/adapter-node (5.3.1)

Reproduction

Steps to Reproduce

1. Create a simple remote function using command from $app/server:

// src/lib/remote/ai.remote.ts
import { command } from '$app/server';

export const simulateAIGeneration = command('unchecked', async (payload) => {
    return {
        enhancedText: 'This is a simulated AI generation: ' + payload.text
    };
});

2. Use the remote function in a Svelte component:

<script lang="ts">
import { simulateAIGeneration } from '../lib/remote/ai.remote';

let inputText = '';
let enhancedText = '';
let loading = false;
let error = '';

async function handleEnhance() {
    loading = true;
    error = '';
    enhancedText = '';
    try {
        const result = await simulateAIGeneration({ text: inputText });
        enhancedText = result.enhancedText;
    } catch (e) {
        if (e instanceof Error) {
            error = e.message;
        } else {
            error = 'Failed to enhance text.';
        }
    } finally {
        loading = false;
    }
}
</script>

3. Deploy to Railway using the provided Dockerfile and docker-compose.yml
4. Access the deployed application and try to use the remote function
5. Observe the 403 error with the response: {"message":"Cross-site remote requests are forbidden"}

Expected Behavior

The remote function should work in production deployment just as it does in development.

Actual Behavior

The remote function call fails with a 403 Forbidden status code and the response:

{"message":"Cross-site remote requests are forbidden"}

Additional Information

Repository: https://github.com/thisuxhq/remotetest
Live Demo: https://remotetest-production.up.railway.app/

The application is a simple text enhancer that demonstrates the issue. The remote function works perfectly in development mode (bun run dev) but fails when deployed to Railway.

Configuration Files

The deployment uses:

• Docker containerization
• @sveltejs/adapter-node for server-side rendering
• Railway as the hosting platform

Logs

{"message":"Cross-site remote requests are forbidden"}

System Info

System:
    OS: macOS 15.1
    CPU: (8) arm64 Apple M1
    Memory: 91.69 MB / 8.00 GB
    Shell: 5.9 - /bin/zsh
Binaries:
    Node: 23.5.0 - /opt/homebrew/bin/node
    npm: 10.9.2 - /opt/homebrew/bin/npm
    bun: 1.1.42 - /opt/homebrew/bin/bun
Browsers:
    Brave Browser: 139.1.81.137
    Safari: 18.1
npmPackages:
    @sveltejs/adapter-node: ^5.3.1 => 5.3.1 
    @sveltejs/kit: ^2.37.0 => 2.37.0 
    @sveltejs/vite-plugin-svelte: ^6.1.3 => 6.1.3 
    svelte: ^5.38.6 => 5.38.6 
    vite: ^7.1.3 => 7.1.3

Severity

blocking all usage of SvelteKit

Additional Information

Questions

1. Is there a specific configuration needed for remote functions to work in production deployments?
2. Are there any CORS or security settings that need to be configured for Railway deployments?
3. Is this a known limitation of remote functions in certain deployment environments?
4. What causes the 403 "Cross-site remote requests are forbidden" error specifically?

Related

This might be related to CORS configuration or security policies in production environments, but the specific 403 error message suggests it's related to SvelteKit's remote functions security implementation.

Start with the remote function entry point in src/lib/remote/ai.remote.ts and the $app/server command used there, then compare development and production behavior using the Dockerfile and docker-compose.yml deployment. Reproduce the 403 response on Railway and trace the cross-site request handling; done means the same remote function succeeds in the production deployment without the 403.