feat(auth): implement CSRF token protection for state-changing operations

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-02-22 16:27:37 +00:00
parent bb94eccd86
commit c54cbcbdd6
8 changed files with 545 additions and 1 deletions
@@ -18,6 +18,8 @@
          crossorigin="anonymous" referrerpolicy="no-referrer" />
    {% endblock %}
    {% block head_extra %}{% endblock %}
+    <!-- CSRF token for AJAX/fetch requests -->
+    <meta name="csrf-token" content="{{ csrf_token | default('', true) }}">
  </head>

  <body class="bg-gray-50 min-h-screen flex flex-col">
@@ -33,6 +33,7 @@
        <div class="mb-8" id="local-auth">
            <h2 class="text-lg font-semibold mb-4 text-gray-700">Sign in with username</h2>
            <form method="POST" action="/auth" class="space-y-4">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token | default('', true) }}">
                <div>
                    <label for="username" class="block text-sm font-medium text-gray-700">Username</label>
                    <input type="text" id="username" name="username" required