csrf/golang

[zenith garnet]

i dont even thing you need csrf tokens at this point just set the SameSite attribute in your cookies to strict

[fiery beacon]

Same site is when the domain is the same as the api ? Right ?

[candid crown]

That is correct. It is assumed that they are on the same domain as you mentioned submitting a form, which is typically done to the same domain