Build the protection from the session config slice.
The cookie name is derived as <session.name>.csrf rather than configured
separately, so it inherits whatever prefix the session cookie already
carries. That matters for __Host-: the boot guard in sessionStoreModule
already refuses a __Host- session name unless secure is on and no domain
is set, and deriving from it means the CSRF cookie can never disagree with
that verdict — a __Host- cookie the browser silently drops would look
exactly like a client that forgot to send the token.
Build the protection from the
sessionconfig slice.The cookie name is derived as
<session.name>.csrfrather than configured separately, so it inherits whatever prefix the session cookie already carries. That matters for__Host-: the boot guard insessionStoreModulealready refuses a__Host-session name unlesssecureis on and no domain is set, and deriving from it means the CSRF cookie can never disagree with that verdict — a__Host-cookie the browser silently drops would look exactly like a client that forgot to send the token.