diff --git a/app/app.go b/app/app.go
index ed931c2..db71863 100644
--- a/app/app.go
+++ b/app/app.go
@@ -25,6 +25,14 @@ func New(db *db.DB) *App {
 		Handler: r,
 	}
 
+	// TODO: CSRF.
+	// csrfMiddleware := csrf.Protect(
+	// 	[]byte(lib.CSRFKey),
+	// 	// instruct the browser to never send cookies during cross site requests
+	// 	csrf.SameSite(csrf.SameSiteLaxMode),
+	// 	csrf.TrustedOrigins([]string{"localhost:3333", lib.DOMAIN}),
+	// )
+	// r.Use(csrfMiddleware)
 	r.Use(md.GeneralAuth(a.DB))
 	r.Use(md.Messages)
 	// normal website
diff --git a/example.env b/example.env
index e3d437b..f66bffe 100644
--- a/example.env
+++ b/example.env
@@ -2,4 +2,5 @@ SQLITE_PATH=data/farga.sqlite
 DOMAIN=localhost
 PORT=3333
 HACKATIME_CLIENT_ID=# https://hackatime.hackclub.com/docs/oauth/oauth-apps
-HACKATIME_CLIENT_SECRET=# https://hackatime.hackclub.com/docs/oauth/oauth-apps
\ No newline at end of file
+HACKATIME_CLIENT_SECRET=# https://hackatime.hackclub.com/docs/oauth/oauth-apps
+CSRF_KEY=Sup3r-s3cr3t-l0ng-w1th-numbers-key-h3r3
\ No newline at end of file
diff --git a/go.mod b/go.mod
index 405c2bd..d80c1d8 100644
--- a/go.mod
+++ b/go.mod
@@ -17,6 +17,7 @@ require (
 	github.com/go-git/go-billy/v6 v6.0.0-alpha.1 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
@@ -31,6 +32,7 @@ require (
 	github.com/go-git/go-git/v6 v6.0.0-alpha.4
 	github.com/go-playground/validator/v10 v10.30.3
 	github.com/google/uuid v1.6.0
+	github.com/gorilla/csrf v1.7.3
 	github.com/gorilla/mux v1.8.1
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
diff --git a/go.sum b/go.sum
index 17f4a9b..e8fb882 100644
--- a/go.sum
+++ b/go.sum
@@ -33,10 +33,16 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.30.3 h1:4MU6YkEwx7GbcPJOZxrtbu+QfF3pJLJuaYTeAH0DYy8=
 github.com/go-playground/validator/v10 v10.30.3/go.mod h1:4Axh7oCNGcoGkqLoE4YWt6n20mcEIsPRlB7vPk3lpyc=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/csrf v1.7.3 h1:BHWt6FTLZAb2HtWT5KDBf6qgpZzvtbp9QWDRKZMXJC0=
+github.com/gorilla/csrf v1.7.3/go.mod h1:F1Fj3KG23WYHE6gozCmBAezKookxbIvUJT+121wTuLk=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
diff --git a/lib/constants.go b/lib/constants.go
index 6e98198..790db9f 100644
--- a/lib/constants.go
+++ b/lib/constants.go
@@ -18,18 +18,17 @@ const GitHashLength = 8
 const SSHPort = 6969
 const SSHHostKeyPath = "data/host_key"
 
+// env vars.
 var SSHDomain string
-
-func SetSHHDomain(domain string) {
-	SSHDomain = domain
-}
-
 var DOMAIN string
 var PORT uint
+var CSRFKey string
 
-func SetDomainAndPort(domain string, port uint) {
+func SetEnvVars(domain string, port uint, SSHDomain string, csrfKey string) {
 	DOMAIN = domain
 	PORT = port
+	SSHDomain = SSHDomain
+	CSRFKey = csrfKey
 }
 
 const IssueTitleMaxLen = 100
diff --git a/main.go b/main.go
index 6b76464..b8af05b 100644
--- a/main.go
+++ b/main.go
@@ -22,8 +22,13 @@ func loadEnv() {
 		log.Println("\x1b[33mNo .env file found, using system env\x1b[0m") // orange then reset
 	}
 	port, err := strconv.ParseUint(os.Getenv("PORT"), 10, 32)
-	lib.SetDomainAndPort(os.Getenv("DOMAIN"), uint(port))
-	lib.SetSHHDomain(os.Getenv("DOMAIN"))
+
+	if os.Getenv("DOMAIN") == "" || err != nil || os.Getenv("DOMAIN") == "" || os.Getenv("CSRF_KEY") == "" {
+		log.Fatal("You're missing one of the required env vars.")
+		return
+	}
+
+	lib.SetEnvVars(os.Getenv("DOMAIN"), uint(port), os.Getenv("DOMAIN"), os.Getenv("CSRF_KEY"))
 }
 
 func main() {