diff --git a/web/app.js b/web/app.js
index 87dd5d0..32c3332 100644
--- a/web/app.js
+++ b/web/app.js
@@ -23,8 +23,18 @@ function showToast(message, type) {
 async function apiFetch(path, opts) {
   opts = opts || {};
   opts.headers = opts.headers || {};
-  if (csrfToken) {
+  // Send CSRF token both as header AND in POST body (Zoraxy validates via form field)
+  if (csrfToken && csrfToken !== '{{.csrfToken}}') {
     opts.headers['X-Zoraxy-Csrf'] = csrfToken;
+    opts.headers['X-CSRF-Token'] = csrfToken;
+    // For POST requests, also include in body
+    if (!opts.method || opts.method.toUpperCase() === 'POST') {
+      if (opts.body && typeof opts.body === 'object') {
+        opts.body.csrfToken = csrfToken;
+      } else {
+        opts.body = { csrfToken: csrfToken };
+      }
+    }
   }
   if (opts.body && typeof opts.body === 'object') {
     opts.body = JSON.stringify(opts.body);