cclohmar/zoraxy-dhcp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: send CSRF token in POST body field, header, and X-CSRF-Token header

Browse source
This commit is contained in:
Claus Lohmar 2026-07-24 10:30:57 +00:00
parent 8b0bd75f29
commit 037791bbd5
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
web/app.js
View file

@ -23,8 +23,18 @@ function showToast(message, type) {
async function apiFetch(path, opts) { async function apiFetch(path, opts) {
opts = opts || {}; opts = opts || {};
opts.headers = opts.headers || {}; opts.headers = opts.headers || {};
if (csrfToken) { // Send CSRF token both as header AND in POST body (Zoraxy validates via form field)
if (csrfToken && csrfToken !== '{{.csrfToken}}') {
opts.headers['X-Zoraxy-Csrf'] = csrfToken; opts.headers['X-Zoraxy-Csrf'] = csrfToken;
opts.headers['X-CSRF-Token'] = csrfToken;
// For POST requests, also include in body
if (!opts.method || opts.method.toUpperCase() === 'POST') {
if (opts.body && typeof opts.body === 'object') {
opts.body.csrfToken = csrfToken;
} else {
opts.body = { csrfToken: csrfToken };
}
}
} }
if (opts.body && typeof opts.body === 'object') { if (opts.body && typeof opts.body === 'object') {
opts.body = JSON.stringify(opts.body); opts.body = JSON.stringify(opts.body);