diff --git a/server.js b/server.js
index e4ef4d0..d8927ad 100644
--- a/server.js
+++ b/server.js
@@ -213,9 +213,29 @@ app.get("/api/csrf-token", csrfProtection, (req, res) => {
  * =========================
  */
 app.use((req, res, next) => {
+   // Allow safe methods
   if (["GET", "HEAD", "OPTIONS"].includes(req.method)) {
     return next();
   }
+
+  // Only protect API routes
+  if (!req.path.startsWith("/api")) {
+    return next();
+  }
+
+  // Skip auth & public endpoints
+  const csrfExcludedPaths = [
+    "/api/auth/login",
+    "/api/forgot-password/request-otp",
+    "/api/forgot-password/verify-otp",
+    "/api/csrf-token",
+  ];
+
+  if (csrfExcludedPaths.includes(req.path)) {
+    return next();
+  }
+
+  // 🔒 Enforce CSRF
   return csrfProtection(req, res, next);
 });