Stateless security platforms face a unique CSRF protection challenge: they must defend browser-based dashboard sessions against cross-site request forgery while simultaneously accepting legitimate cross-origin requests from Stripe webhooks, SAML identity provider callbacks, and API key-authenticated SDK clients. We present a double-submit cookie CSRF middleware for QCrypton that generates cryptographically random 256-bit tokens via Node.js built-in crypto, sets them as cookies with configurable security attributes (httpOnly=false for JavaScript access, secure in production, SameSite=strict), and validates them on state-changing requests (POST, PUT, DELETE, PATCH) via header (X-CSRF-Token) or body (_csrf) submission. The middleware implements three exemption classes: (1) path-based exemptions for webhook endpoints (/billing/webhook) and SAML callbacks (/auth/saml/callback) that receive server-to-server POSTs, (2) authentication-based exemption for Bearer token requests that are immune to CSRF by design, and (3) method-based exemption for safe HTTP methods (GET, HEAD, OPTIONS). The implementation requires zero external dependencies (61 LOC) and adds less than 0.01ms latency per request. We analyze the security properties of each exemption class and demonstrate that the middleware correctly protects browser sessions while preserving the platform's multi-interface architecture.