fix: CSRF cookie configuration for local network access\n\n- Changed SameSite from Lax to None to allow cookie access across localhost/IP variations\n- Added Secure=false for local development (should be true in production with HTTPS)\n- Added credentials:'include' to all fetch requests to ensure cookies are sent\n- Updated tests to expect credentials parameter in fetch calls\n\nThis fixes the 403 Forbidden error when accessing from LAN IPs like 192.168.x.x

1 files changed, 2 insertions, 1 deletions

diff --git a/web/web.go b/web/web.go
index ffec8b9..d8dd832 100644
--- a/web/web.go
+++ b/web/web.go
@@ -373,7 +373,8 @@ func CSRFMiddleware(next http.Handler) http.Handler {
 				Value:    token,
 				Path:     "/",
 				HttpOnly: false, // accessible by JS
-				SameSite: http.SameSiteLaxMode,
+				SameSite: http.SameSiteNoneMode,
+				Secure:   false, // Set to true in production with HTTPS
 			})
 		} else {
 			token = cookie.Value