diff --git a/routers/web/web.go b/routers/web/web.go
index e0c40b933b8..b882995a1c6 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -345,14 +345,16 @@ func addProjectBoardRoutes(m *web.Router) {
 
 // registerWebRoutes register routes
 func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
-	// required to be signed in or signed out
+	validation.AddBindingRules()
+
+	// middleware: required to be signed in or signed out
 	reqSignIn := verifyAuthWithOptions(&common.VerifyOptions{SignInRequired: true})
 	reqSignOut := verifyAuthWithOptions(&common.VerifyOptions{SignOutRequired: true})
-	// optional sign in (if signed in, use the user as doer, if not, no doer)
+	// middleware: optional sign in (if signed in, use the user as doer, if not, no doer)
 	optSignIn := verifyAuthWithOptions(&common.VerifyOptions{SignInRequired: setting.Service.RequireSignInViewStrict})
 	optExploreSignIn := verifyAuthWithOptions(&common.VerifyOptions{SignInRequired: setting.Service.RequireSignInViewStrict || setting.Service.Explore.RequireSigninView})
-
-	validation.AddBindingRules()
+	// middleware: only apply CrossOriginProtection
+	crossOriginProtect := verifyAuthWithOptions(&common.VerifyOptions{DisableCrossOriginProtection: false})
 
 	openIDSignInEnabled := func(ctx *context.Context) {
 		if !setting.Service.EnableOpenIDSignIn {
@@ -548,7 +550,7 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
 	m.Post("/-/markup", reqSignIn, web.Bind[*structs.MarkupOption](), misc.Markup)
 	m.Post("/-/web-banner/dismiss", misc.WebBannerDismiss)
 	m.Get("/-/web-theme/list", misc.WebThemeList)
-	m.Post("/-/web-theme/apply", optSignIn, misc.WebThemeApply)
+	m.Post("/-/web-theme/apply", crossOriginProtect, misc.WebThemeApply)
 
 	m.Group("/explore", func() {
 		m.Get("", func(ctx *context.Context) {
diff --git a/tests/integration/signin_test.go b/tests/integration/signin_test.go
index d703625ea5e..695fcab6e5b 100644
--- a/tests/integration/signin_test.go
+++ b/tests/integration/signin_test.go
@@ -17,6 +17,7 @@ import (
 	"gitea.dev/modules/test"
 	"gitea.dev/modules/translation"
 	"gitea.dev/modules/web"
+	"gitea.dev/modules/web/middleware"
 	"gitea.dev/routers"
 	"gitea.dev/routers/web/auth"
 	"gitea.dev/services/context"
@@ -183,9 +184,17 @@ func TestRequireSignInView(t *testing.T) {
 	t.Run("RequireSignInView", func(t *testing.T) {
 		defer test.MockVariableValue(&setting.Service.RequireSignInViewStrict, true)()
 		defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
-		req := NewRequest(t, "GET", "/user2/repo1/src/branch/master")
-		resp := MakeRequest(t, req, http.StatusSeeOther)
-		assert.Equal(t, "/user/login?redirect_to=%2Fuser2%2Frepo1%2Fsrc%2Fbranch%2Fmaster", resp.Header().Get("Location"))
+		t.Run("AccessPublicRepo", func(t *testing.T) {
+			req := NewRequest(t, "GET", "/user2/repo1/src/branch/master")
+			resp := MakeRequest(t, req, http.StatusSeeOther)
+			assert.Equal(t, "/user/login?redirect_to=%2Fuser2%2Frepo1%2Fsrc%2Fbranch%2Fmaster", resp.Header().Get("Location"))
+		})
+		t.Run("UpdateTheme", func(t *testing.T) {
+			session := emptyTestSession(t)
+			req := NewRequest(t, "POST", "/-/web-theme/apply?theme=gitea-dark")
+			session.MakeRequest(t, req, http.StatusOK)
+			assert.Equal(t, "gitea-dark", session.GetSiteCookie(middleware.CookieTheme))
+		})
 	})
 	t.Run("BlockAnonymousAccessExpensive", func(t *testing.T) {
 		defer test.MockVariableValue(&setting.Service.RequireSignInViewStrict, false)()