Index: src/server.js
===================================================================
--- src/server.js	(revision ae924a2babb279ac76f99438ade75ab50968359c)
+++ src/server.js	(revision 9e27d64c70dff768f7a07cb5f10586ad65f56c42)
@@ -148,4 +148,18 @@
 app.use(loadTheme);
 
+// Lichtgewicht CSRF-defense: weiger cross-origin state-wijzigende requests.
+// Same-origin forms + HTMX sturen een matchende Origin; ontbreekt Origin dan
+// laten we door (non-browser clients). sameSite:'lax' op de sessiecookie is de
+// tweede laag. (Geldt niet voor GET/HEAD/OPTIONS.)
+app.use((req, res, next) => {
+  if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next();
+  const origin = req.get('origin');
+  if (!origin) return next(); // geen Origin -> geen browser-CSRF-vector
+  let originHost;
+  try { originHost = new URL(origin).host; } catch { return res.status(403).send('Ongeldige origin'); }
+  if (originHost !== req.get('host')) return res.status(403).send('Cross-origin request geweigerd');
+  next();
+});
+
 app.use('/auth', authRoutes);
 app.use('/account', accountRoutes);
@@ -328,5 +342,5 @@
   console.log(`   ✓ Privacy:  Self-hosted fonts, no third-party requests`);
   console.log(`   ✓ Layout:   v9 editorial feel (top nav, profile header)`);
-  console.log(`   ✓ Auth:     Google login / logout`);
+  console.log(`   ✓ Auth:     wachtwoord (beheer) + Google (luisteraars) / logout`);
   console.log(`   ✓ Posts:    create / edit / view / archive`);
   console.log(`   ✓ Realtime: WebSocket server ready (Prutter)`);