POST /cart/add returns 401 → 403 with Clear-Site-Data header via local dev proxy

[LucasBalbinoSS]

Bug Description

When running shopify theme dev, POST requests to /cart/add fail with:

1. 401 Unauthorized (empty body)
2. 403 Forbidden (HTML response: <!DOCTYPE ...)

The response to /cart/add includes an unusual Clear-Site-Data header, which appears to be terminating the session and causing the 401 → 403 cascade.

GET requests work normally. The cart works correctly when accessing the store via the preview URL (?preview_theme_id=).

Environment

• CLI version: 3.94.3
• Store: emaus-7331.myshopify.com
• Development theme ID: 181626339439
• OS: macOS

Steps to Reproduce

1. Run shopify theme dev --store emaus-7331.myshopify.com
2. Open the local preview at 127.0.0.1
3. Try to add a product to the cart
4. Observe POST /cart/add returning 401 (empty body) then 403 (HTML)

Already Tried

• Updated CLI from 3.92.1 to 3.94.3
• shopify auth logout + shopify auth login + restarted dev server
• Cleared all CLI cache at ~/Library/Preferences/shopify-cli-*
• Disabled store password protection
• Problem persists in all cases

Expected Behavior

POST /cart/add should return a JSON response with cart data.

Actual Behavior

Returns 401 (empty body) then 403 (HTML with <!DOCTYPE) with Clear-Site-Data header on the response.

[devinenoise]

This started happening for me on Friday. Same CLI version and reproducible outcomes as OP.

This was an issue in a previous version of the CLI and then patched. Wondering what happened.

warning ────────────────────────────────────────────────────────────────────╮
│ │
│ Failed to render section on Hot Reload with status 403 (Forbidden).

Error │
│ at Rg (file:///C:/Users/USERFS/AppData/Roaming/npm/node_modules/@shopi │
│ fy/cli/dist/index.js:2625:12292) │
│ at eA (file:///C:/Users/USERFS/AppData/Roaming/npm/node_modules/@shopi │
│ fy/cli/dist/index.js:2633:234) │
│ at file:///C:/Users/USERFS/AppData/Roaming/npm/node_modules/@shopify/c │
│ li/dist/index.js:2756:5055 │
│ at process.processTicksAndRejections │
│ (node:internal/process/task_queues:103:5) │
│ at async Object.handler (file:///C:/Users/USERFS/AppData/Roaming/npm/n │
│ ode_modules/@shopify/cli/dist/index.js:2631:6407) │
│ at async Server. (file:///C:/Users/USERFS/AppData/Roaming/n │
│ pm/node_modules/@shopify/cli/dist/index.js:2631:10005)

[hasbiriza]

I also experienced the same issue

[noahsark769]

Also seeing this, it seems like something on Shopify's backend changed in the last few days which started generating cloudflare site challenges on these endpoints. This seems like a misconfiguration, since these are documented AJAX API endpoints and they should not require verification. https://community.shopify.com/t/why-am-i-encountering-a-403-error-with-my-ajax-mini-cart/46836/2 is another instance. @isaacroldan or @alfonso-noriega I noticed you've been active in this repo lately, do you think you could put us in touch with the right people to resolve this? noah@replo.app is my email if email is better!