Fix CSP violation on login page by moving inline script to external file

1 files changed, 8 insertions, 0 deletions

diff --git a/web/static/login_script.js b/web/static/login_script.js
new file mode 100644
index 0000000..75d29f4
--- /dev/null
+++ b/web/static/login_script.js
@@ -0,0 +1,8 @@
+window.addEventListener('DOMContentLoaded', function () {
+    var match = document.cookie.split('; ').find(function (row) { return row.startsWith('csrf_token='); });
+    if (match) {
+        var token = match.split('=')[1];
+        var input = document.getElementById('csrf_token');
+        if (input) input.value = token;
+    }
+});