hotfix

Author: boutell

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 4.23.1 (2025-11-06)
+
+### Fixes
+
+* Hotfix: specify the content type when calling back to Astro with JSON to render an area. This is required starting in Astro 4.9.0 and up, otherwise the request is blocked by CSRF protection. This fix allows [section-template-library](https://apostrophecms.com/extensions/section-template-library) previews to work.
+
 ## 4.23.0 (2025-10-30)
 
 ### Adds

modules/@apostrophecms/area/index.js

@@ -376,7 +376,9 @@ module.exports = {
           const response = await fetch(`${self.apos.baseUrl}/api/apos-external-front/render-area`, {
             method: 'POST',
             headers: {
-              'apos-external-front-key': self.apos.externalFrontKey
+              'apos-external-front-key': self.apos.externalFrontKey,
+              // Without this Astro enforces CSRF protection starting in version 4.9.0
+              'content-type': 'application/json'
             },
             body: JSON.stringify({
               area

package.json

@@ -1,6 +1,6 @@
 {
   "name": "apostrophe",
-  "version": "4.23.0",
+  "version": "4.23.1",
   "description": "The Apostrophe Content Management System.",
   "main": "index.js",
   "scripts": {