diff --git a/Tombolo/.env.sample b/Tombolo/.env.sample
index d600501c..f9559988 100644
--- a/Tombolo/.env.sample
+++ b/Tombolo/.env.sample
@@ -41,6 +41,7 @@ API_KEY_DURATION=
 # Authentication and Authorization Configuration
 JWT_SECRET=
 JWT_REFRESH_SECRET=
+CSRF_SECRET=
 
 # OAuth 2.0 - Azure
 TENENT_ID=
diff --git a/Tombolo/server/middlewares/csrfMiddleware.js b/Tombolo/server/middlewares/csrfMiddleware.js
index d2942d30..78d28b80 100644
--- a/Tombolo/server/middlewares/csrfMiddleware.js
+++ b/Tombolo/server/middlewares/csrfMiddleware.js
@@ -10,7 +10,9 @@ const csrf = doubleCsrf({
 
       const decoded = verifyToken(token, process.env.JWT_SECRET);
 
-      const secret = process.env.CSRF_SECRET + decoded.id;
+      const secret = process.env.CSRF_SECRET
+        ? process.env.CSRF_SECRET
+        : "secret" + decoded.id;
 
       return secret;
     } catch (e) {