diff --git a/README.md b/README.md index 5fa5363..ab01643 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ Notes: ``` -- CSRF: hime ships no CSRF middleware — wire your token with `hx-headers`, e.g. ``. Use per-session (not per-request) tokens, or set `hx-history="false"`, since htmx snapshots pages into localStorage. +- CSRF: set `SameSite=Lax` (or `Strict`) explicitly on your session cookie and never mutate state on GET — that alone stops classic cross-site form CSRF in modern browsers. For defense-in-depth (untrusted subdomains are still "same-site"), wrap your handler with the standard library's [`http.NewCrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection): `app.Handler(cop.Handler(mux))` — hime adds nothing because it composes directly. If you use token middleware anyway, wire it with `hx-headers`, e.g. ``, and prefer per-session tokens (or set `hx-history="false"`) since htmx snapshots pages into localStorage. ## License