So, rn, the kratos server runs on 4434 , and the golang client (4455) acts as a bff between frontend (5173) . So, on page load this handler is called.

func startSignupFlow(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	flow, _, err := oryClient.FrontendAPI.CreateBrowserRegistrationFlow(ctx).Execute()
	if err != nil {
		log.Error().Err(err).Msg("failed to create registration flow")
		http.Error(w, `{"err": "registration init failed"}`, http.StatusInternalServerError)
		return
	}

	response := serializes(flow)

    for _, cookie := range cookies {
		http.SetCookie(w, cookie)
	}
	w.WriteHeader(http.StatusOK)
	w.Write(response)
}

now when I load the frontend page and try to use the email password login, i get a csrf token rejection error.

error=map[debug: details:map[docs:<https://www.ory.sh/kratos/docs/debug/csrf> hint:The anti-CSRF cookie was found but the CSRF token was not included in the HTTP request body (csrf_token) nor in the HTTP Header (X-CSRF-Token). reject_reason:The HTTP Cookie Header was set and a CSRF token was sent but they do not match.

I accessed 127.0.0.1:4434 4455 and 5173 cleared cache. but this persists even in --dev mode. everything is 127.0.0.1. what am I doing wrong. Is this because of the SameSite=Lax