diff --git a/server/src/server/server.ts b/server/src/server/server.ts
index 005adcd78..6b90adb25 100644
--- a/server/src/server/server.ts
+++ b/server/src/server/server.ts
@@ -33,6 +33,7 @@ const userSessionMiddleware = expressSession({
 	saveUninitialized: false,
 	cookie: {
 		secure: process.env.NODE_ENV === "production" || ServerConfig.ENABLE_SERVER_HTTPS,
+		sameSite: "lax", // Very important. Without this, we're vulnerable to CSRF!
 	},
 });