cgalo5758 94334c0e64 Document CSRF removal in favor of cross-origin checks ...

The server no longer uses CSRF tokens, relying instead on the origin
check in `internal/middleware/csrf.go`. Update all documentation, code
comments, error handling, and specs to reflect the new protection model
and remove the `csrf-secret` configuration key.

2026-09-21 14:35:35 -05:00

..

spec.md

Document CSRF removal in favor of cross-origin checks

2026-09-21 14:35:35 -05:00