src/app/start.ts

@@ -1,8 +1,13 @@
-import { createStart } from "@tanstack/react-start";
+import { createCsrfMiddleware, createStart } from "@tanstack/react-start";
 import { serverFnLoggingMiddleware } from "@/utils/activities";
 
+const csrfMiddleware = createCsrfMiddleware({
+  filter: (ctx) => ctx.handlerType === "serverFn",
+});
+
 // Global function middleware: every server fn (current and future) is audited
 // without opting in at the definition site.
 export const startInstance = createStart(() => ({
+  requestMiddleware: [csrfMiddleware],
   functionMiddleware: [serverFnLoggingMiddleware],
 }));