Add CSRF protection for cookie-authenticated requests

2026-03-23 16:20:26 +01:00
parent a3348e8795
commit fae7f80913
8 changed files with 139 additions and 17 deletions
--- a/templates/changePassword.html
+++ b/templates/changePassword.html
@@ -258,9 +258,12 @@
        }

        try {
+            const m = document.cookie.match('(^|;)\\s*csrf_token\\s*=\\s*([^;]+)');
+            const csrf = m ? m.pop() : '';
+
            const res = await fetch('/api/user/change-password', {
                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf },
                body: JSON.stringify({
                    old_password: current,
                    new_password: nv