CSRF token removed only for login api : GWM

server.js

@@ -16,13 +16,16 @@ require("dotenv").config();
 
 const csrf = require("csurf");
 
-// cookie-based CSRF protection
+const isProd = process.env.NODE_ENV === "production";
+
 const csrfProtection = csrf({
   cookie: {
     key: "_csrf",
-    httpOnly: true,
+    httpOnly: true,           // always true
-    secure: process.env.NODE_ENV === "production",
+    secure: isProd,           // true only in production (HTTPS)
-    sameSite: "strict",
+    sameSite: isProd ? "none" : "lax", 
+    // prod: cross-domain frontend → backend
+    // dev : localhost friendly
   },
 });