diff --git a/middleware.ts b/middleware.ts
index 1410a7c..d98648a 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -2,10 +2,15 @@ import { NextResponse, type NextRequest } from 'next/server';
 import { isCsrfProtectedRequest, isTrustedRequestOrigin } from '@/lib/csrf';
 
 export function middleware(request: NextRequest) {
-  if (isCsrfProtectedRequest(request) && !isTrustedRequestOrigin(request)) {
+  console.log('[middleware] path:', request.nextUrl.pathname, 'method:', request.method, 'origin:', request.headers.get('origin'));
+  const csrfProtected = isCsrfProtectedRequest(request);
+  const trusted = isTrustedRequestOrigin(request);
+  console.log('[middleware] csrfProtected:', csrfProtected, 'trusted:', trusted);
+  if (csrfProtected && !trusted) {
+    console.log('[middleware] BLOCKING request');
     return NextResponse.json({ error: 'Invalid request origin' }, { status: 403 });
   }
-
+  console.log('[middleware] ALLOWING request');
   return NextResponse.next();
 }