From 3d56613ddc3d3ff080d5a6d8ebf0b006128ef3bd Mon Sep 17 00:00:00 2001
From: zkldi <ktchidev@gmail.com>
Date: Sat, 4 Sep 2021 11:16:05 +0100
Subject: [PATCH] Add CSRF Protection

---
 server/src/server/server.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/src/server/server.ts b/server/src/server/server.ts
index 005adcd78..6b90adb25 100644
--- a/server/src/server/server.ts
+++ b/server/src/server/server.ts
@@ -33,6 +33,7 @@ const userSessionMiddleware = expressSession({
 	saveUninitialized: false,
 	cookie: {
 		secure: process.env.NODE_ENV === "production" || ServerConfig.ENABLE_SERVER_HTTPS,
+		sameSite: "lax", // Very important. Without this, we're vulnerable to CSRF!
 	},
 });