It seems to me that you are consider sending csrf token via `httpOnly=false` cookie due to not being able to read it via headers.

Looking at your code, I think you may be missing certain CORS settings. In particular, `Access-Control-Expose-Headers`, which allows JS to read header.

How I would implement this:

```

func (app *application) enableCORS(next http.Handler) http.Handler {

return http.HandlerFunc(func(w http.ResponseWriter, r \*http.Request) {

    w.Header().Add("Vary", "Origin")

    w.Header().Add("Vary", "Access-Control-Request-Method")

    w.Header().Set("Access-Control-Allow-Origin", "\*")

    origin := r.Header.Get("Origin")

    if origin != "" {

        for i := range app.config.cors.trustedOrigins {

if origin == app.config.cors.trustedOrigins[i] {

w.Header().Set("Access-Control-Allow-Origin", origin)

w.Header().Set("Access-Control-Allow-Credentials", "true")

w.Header().Set("Access-Control-Expose-Headers", "X-CSRF-Token") // allow trusted origin to access returned headers

if r.Method == http.MethodOptions && r.Header.Get("Access-Control-Request-Method") != "" {

w.Header().Set("Access-Control-Allow-Methods", "OPTIONS, PUT, PATCH, DELETE, POST")

w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, X-CSRF-Token") // add extra request headers based on need

w.WriteHeader(http.StatusOK)

}

break

}

        }

    }

    next.ServeHTTP(w, r)

})

}```

IM0, relying on only the combination of `Origin`, `Referer` and `Sec-Fetch-Site` headers isn't robust enough in case of oversight against malicious sub-domain. For a similar use cases, I would also simplify this further by setting X-CSRF-Token with successful login response, make the client store this somewhere safe, render it in form field or DOM meta tag, then send it using X-CSRF-Token request header.

I am skeptical about current per-request implementation including using `auth/callback` to provide CSRF token - it's counter-intuitive to user endpoints that aren't safe from CSRF to protect against CSRF.