diff --git a/server.js b/server.js
index f1e9ece..1ad9322 100644
--- a/server.js
+++ b/server.js
@@ -16,13 +16,16 @@ require("dotenv").config();
 
 const csrf = require("csurf");
 
-// cookie-based CSRF protection
+const isProd = process.env.NODE_ENV === "production";
+
 const csrfProtection = csrf({
   cookie: {
     key: "_csrf",
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "strict",
+    httpOnly: true,           // always true
+    secure: isProd,           // true only in production (HTTPS)
+    sameSite: isProd ? "none" : "lax", 
+    // prod: cross-domain frontend → backend
+    // dev : localhost friendly
   },
 });