From 037791bbd532691492d3ec621431ccc4d72669b3 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Fri, 24 Jul 2026 10:30:57 +0000
Subject: [PATCH] fix: send CSRF token in POST body field, header, and
 X-CSRF-Token header

---
 web/app.js | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/web/app.js b/web/app.js
index 87dd5d0..32c3332 100644
--- a/web/app.js
+++ b/web/app.js
@@ -23,8 +23,18 @@ function showToast(message, type) {
 async function apiFetch(path, opts) {
   opts = opts || {};
   opts.headers = opts.headers || {};
-  if (csrfToken) {
+  // Send CSRF token both as header AND in POST body (Zoraxy validates via form field)
+  if (csrfToken && csrfToken !== '{{.csrfToken}}') {
     opts.headers['X-Zoraxy-Csrf'] = csrfToken;
+    opts.headers['X-CSRF-Token'] = csrfToken;
+    // For POST requests, also include in body
+    if (!opts.method || opts.method.toUpperCase() === 'POST') {
+      if (opts.body && typeof opts.body === 'object') {
+        opts.body.csrfToken = csrfToken;
+      } else {
+        opts.body = { csrfToken: csrfToken };
+      }
+    }
   }
   if (opts.body && typeof opts.body === 'object') {
     opts.body = JSON.stringify(opts.body);