diff --git a/backend/src/app.ts b/backend/src/app.ts
index 20c105a3..138ad781 100644
--- a/backend/src/app.ts
+++ b/backend/src/app.ts
@@ -40,9 +40,7 @@ const app = express()
 app.use(express.json({ limit: '50mb' }))
 app.use(cors())
 app.use(compression())
-
 app.use(responseLogger)
-
 if (!ENABLE_WRITE && RUNNING_ENV !== 'dev') {
   app.use(blockWriteRequests)
 }
diff --git a/backend/src/middlewares/misc.ts b/backend/src/middlewares/misc.ts
index d3f825e5..5ec4d17c 100644
--- a/backend/src/middlewares/misc.ts
+++ b/backend/src/middlewares/misc.ts
@@ -3,6 +3,9 @@ import { Middleware } from '../types'
 /* Disables all write routes except the ones excluded by "allowedRoutes" */
 export const blockWriteRequests: Middleware = (req, res, next) => {
   const allowedRoutes = [
+    '/crosssearch/all',
+    '/crosssearch/localities',
+    '/crosssearch/export',
     '/user/login',
     '/locality-species',
     '/refreshToken',
diff --git a/backend/src/routes/crossSearch.ts b/backend/src/routes/crossSearch.ts
index dcfba9e5..ae1b0966 100644
--- a/backend/src/routes/crossSearch.ts
+++ b/backend/src/routes/crossSearch.ts
@@ -175,7 +175,7 @@ const streamCrossSearchExport = async (req: Request, res: Response, parameters:
   let dataArray: Partial<CrossSearch[][]>
   try {
     dataArray = (await getCrossSearchRawSql(
-      req.user,
+      req.user, // req.user comes from the userExtractor middleware, so should be secure
       undefined,
       undefined,
       parsedValues.validatedValues.validatedColumnFilters,