a

1 files changed, 10 insertions, 1 deletions

diff --git a/cmd/server/main.go b/cmd/server/main.go
index 4f0d30f..b89362b 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -186,10 +186,19 @@ func main() {
 	// In production, you should set csrf.Secure(true).
 	// You can use an environment variable to control this setting.
 	csrfOptions := []csrf.Option{
-		csrf.Secure(true), // Set to true in production
+		csrf.Secure(os.Getenv("ENV") == "production"),
 		csrf.Path("/"),
 	}
 
+	sameSiteMode := csrf.SameSiteLaxMode
+	switch strings.ToLower(os.Getenv("CSRF_SAME_SITE")) {
+	case "strict":
+		sameSiteMode = csrf.SameSiteStrictMode
+	case "none":
+		sameSiteMode = csrf.SameSiteNoneMode
+	}
+	csrfOptions = append(csrfOptions, csrf.SameSite(sameSiteMode))
+
 	trustedOrigins := os.Getenv("CSRF_TRUSTED_ORIGINS")
 	if trustedOrigins != "" {
 		origins := strings.Split(trustedOrigins, ",")