From de5c505e0125b5b28e11f52c2ec221ebd9e9abb4 Mon Sep 17 00:00:00 2001
From: Gowtham M <gowtham.m@venbainfotech.com>
Date: Thu, 18 Dec 2025 19:54:36 +0530
Subject: [PATCH] CSRF token removed only for login api : GWM

---
 server.js | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/server.js b/server.js
index f1e9ece..1ad9322 100644
--- a/server.js
+++ b/server.js
@@ -16,13 +16,16 @@ require("dotenv").config();
 
 const csrf = require("csurf");
 
-// cookie-based CSRF protection
+const isProd = process.env.NODE_ENV === "production";
+
 const csrfProtection = csrf({
   cookie: {
     key: "_csrf",
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "strict",
+    httpOnly: true,           // always true
+    secure: isProd,           // true only in production (HTTPS)
+    sameSite: isProd ? "none" : "lax", 
+    // prod: cross-domain frontend → backend
+    // dev : localhost friendly
   },
 });