Default enforceCsrf: true for all environments

davidjamesstone · davidjamesstone · commit 41442057959b · 2025-11-10T11:45:42.000Z
diff --git a/src/config/index.ts b/src/config/index.ts
@@ -55,7 +55,7 @@ export const config = convict({
   },
   enforceCsrf: {
     format: Boolean,
-    default: isProduction,
+    default: true,
     env: 'ENFORCE_CSRF'
   },
 
