cclohmar/zoraxy-dhcp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: only add CSRF body field on POST requests, not GET

Browse source
This commit is contained in:
Claus Lohmar 2026-07-24 10:51:20 +00:00
parent 037791bbd5
commit 78cae8dea4
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
web/app.js
View file

@ -23,12 +23,13 @@ function showToast(message, type) {
async function apiFetch(path, opts) { async function apiFetch(path, opts) {
opts = opts || {}; opts = opts || {};
opts.headers = opts.headers || {}; opts.headers = opts.headers || {};
// Send CSRF token both as header AND in POST body (Zoraxy validates via form field) var method = (opts.method || 'GET').toUpperCase();
var isPost = (method === 'POST' || method === 'PUT' || method === 'PATCH');
if (csrfToken && csrfToken !== '{{.csrfToken}}') { if (csrfToken && csrfToken !== '{{.csrfToken}}') {
opts.headers['X-Zoraxy-Csrf'] = csrfToken; opts.headers['X-Zoraxy-Csrf'] = csrfToken;
opts.headers['X-CSRF-Token'] = csrfToken; // For POST requests, include token in body (Zoraxy validates via form field)
// For POST requests, also include in body if (isPost) {
if (!opts.method || opts.method.toUpperCase() === 'POST') {
if (opts.body && typeof opts.body === 'object') { if (opts.body && typeof opts.body === 'object') {
opts.body.csrfToken = csrfToken; opts.body.csrfToken = csrfToken;
} else { } else {
@ -45,7 +46,6 @@ async function apiFetch(path, opts) {
try { try {
var data = JSON.parse(text); var data = JSON.parse(text);
} catch (e) { } catch (e) {
// Zoraxy may intercept error responses and return HTML
throw new Error('Unexpected response (status ' + res.status + '). Check plugin is running.'); throw new Error('Unexpected response (status ' + res.status + '). Check plugin is running.');
} }
if (!res.ok) { if (!res.ok) {