diff --git a/lib/server-init.js b/lib/server-init.js
index 4b4d71c5..55e32c44 100644
--- a/lib/server-init.js
+++ b/lib/server-init.js
@@ -110,7 +110,12 @@ function createServer_p(configFilePath, options) {
   let useCompression = true;
 
   var clientSessionMiddleware = client_sessions({
-    secret: crypto.randomBytes(16).toString('hex')
+    secret: crypto.randomBytes(16).toString('hex'),
+    // Mitigate CSRF by preventing the session cookie from being sent along
+    // with cross-site requests.
+    cookie: {
+      sameSite: 'lax'
+    }
   });
 
   // Setup a placeholder middleware function until we can create one after