From 78cae8dea44bf22aec793a8322df3cf20ccf08ab Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Fri, 24 Jul 2026 10:51:20 +0000
Subject: [PATCH] fix: only add CSRF body field on POST requests, not GET

---
 web/app.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/web/app.js b/web/app.js
index 32c3332..3b263e9 100644
--- a/web/app.js
+++ b/web/app.js
@@ -23,12 +23,13 @@ function showToast(message, type) {
 async function apiFetch(path, opts) {
   opts = opts || {};
   opts.headers = opts.headers || {};
-  // Send CSRF token both as header AND in POST body (Zoraxy validates via form field)
+  var method = (opts.method || 'GET').toUpperCase();
+  var isPost = (method === 'POST' || method === 'PUT' || method === 'PATCH');
+  
   if (csrfToken && csrfToken !== '{{.csrfToken}}') {
     opts.headers['X-Zoraxy-Csrf'] = csrfToken;
-    opts.headers['X-CSRF-Token'] = csrfToken;
-    // For POST requests, also include in body
-    if (!opts.method || opts.method.toUpperCase() === 'POST') {
+    // For POST requests, include token in body (Zoraxy validates via form field)
+    if (isPost) {
       if (opts.body && typeof opts.body === 'object') {
         opts.body.csrfToken = csrfToken;
       } else {
@@ -45,7 +46,6 @@ async function apiFetch(path, opts) {
   try {
     var data = JSON.parse(text);
   } catch (e) {
-    // Zoraxy may intercept error responses and return HTML
     throw new Error('Unexpected response (status ' + res.status + '). Check plugin is running.');
   }
   if (!res.ok) {