diff --git a/offline-backend-20260512/backend/app/gateway/csrf_middleware.py b/offline-backend-20260512/backend/app/gateway/csrf_middleware.py
index a4269f55..b471e207 100644
--- a/offline-backend-20260512/backend/app/gateway/csrf_middleware.py
+++ b/offline-backend-20260512/backend/app/gateway/csrf_middleware.py
@@ -37,9 +37,17 @@ def should_check_csrf(request: Request) -> bool:
     if request.method not in ("POST", "PUT", "DELETE", "PATCH"):
         return False
 
-    path = request.url.path.rstrip("/")
+    path = request.url.path
+    stripped = path.rstrip("/")
     # Exempt /api/v1/auth/me endpoint
-    if path == "/api/v1/auth/me":
+    if stripped == "/api/v1/auth/me":
+        return False
+    # Anonymous public endpoints (mirror auth_middleware._PUBLIC_PATH_PREFIXES).
+    # These intentionally have no cookie session, so the Double-Submit Cookie
+    # pattern is both impossible (no token to compare) and unnecessary (no
+    # session for an attacker to ride). Without this exemption every public
+    # PUT/POST returns 403 even though auth was bypassed earlier in the chain.
+    if path.startswith("/api/public/"):
         return False
     return True