My payment providers is getting `403 Forbidden: Cross-site POST form submissions are forbidden`. trustedOrigins not helping.

Describe the bug

My payment providers is getting 403 Forbidden: Cross-site POST form submissions are forbidden when making their success callback to my site after a payment.

trustedOrigins not helping as my payment provider doesn't set headers.origin, which is the only thing trustedOrigins checks as far as I can see. The payment provider sets their hostname in referrer instead.

So a fix would be to add a check for headers.referrer here too:
https://github.com/sveltejs/kit/blob/9909a2975436fb6d8d629d4469441666d5e38d7d/packages/kit/src/runtime/server/respond.js#L78

Reproduction

Derp. Is this even feasible to do?

Logs

System Info

System:
    OS: macOS 15.6.1
    CPU: (8) arm64 Apple M1 Pro
    Memory: 114.30 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.18.0 - /Users/samalrasmussen/.nvm/versions/node/v22.18.0/bin/node
    Yarn: 1.22.22 - /opt/homebrew/bin/yarn
    npm: 11.6.0 - /Users/samalrasmussen/.nvm/versions/node/v22.18.0/bin/npm
    pnpm: 10.14.0 - /Users/samalrasmussen/Library/pnpm/pnpm
    Deno: 1.35.2 - /Users/samalrasmussen/.deno/bin/deno
    Watchman: 2025.06.30.00 - /opt/homebrew/bin/watchman
  Browsers:
    Brave Browser: 140.1.82.173
    Chrome: 141.0.7390.55
    Firefox: 144.0.2
    Safari: 18.6
  npmPackages:
    @sveltejs/adapter-node: 5.3.3 => 5.3.3 
    @sveltejs/kit: 2.43.7 => 2.43.7 
    @sveltejs/vite-plugin-svelte: 6.2.1 => 6.2.1 
    svelte: 5.39.8 => 5.39.8 
    vite: 7.1.8 => 7.1.8

Severity

blocking an upgrade

Additional Information

No response

Start at packages/kit/src/runtime/server/respond.js around the linked line and trace how trustedOrigins and the cross-site POST rejection use request headers. Compare that behavior with the payment provider's referrer-only callback and determine whether the requested handling is safe and feasible; done means the expected callback behavior is decided and verified.