[makkes]

The code he provides doesn't compile and needs to be changed like so:

  --- main_before.go      2025-10-15 09:56:16.467115934 +0200
  +++ main.go     2025-10-15 09:52:14.798134654 +0200
  @@ -13,8 +13,10 @@
  
          slog.Info("starting server on :4000")
  
  +       csrfProt := http.NewCrossOriginProtection()
  +
          // Wrap the mux with the http.NewCrossOriginProtection middleware.
  -       err := http.ListenAndServe(":4000", http.NewCrossOriginProtection(mux))
  +       err := http.ListenAndServe(":4000", csrfProt.Handler(mux))
          if err != nil {
                  slog.Error(err.Error())
                  os.Exit(1)

[alex_edwards]

Thanks for pointing this out, what a facepalm. I've fixed it in the post.