Enhance CSRF protection for login page

Login form now includes a CSRF token from the cookie as a hidden form
field. The CSRF middleware accepts tokens from either the X-CSRF-Token
header (for JS clients) or the csrf_token form field (for HTML forms).
Removed /login from the CSRF exclusion list so login POSTs are now
validated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/web/web.go b/web/web.go
index 997a05a..bb11d60 100644
--- a/web/web.go
+++ b/web/web.go
@@ -380,11 +380,15 @@ func CSRFMiddleware(cfg *config.Settings, next http.Handler) http.Handler {
 		}
 
 		path := strings.TrimSuffix(r.URL.Path, "/")
-		isExcluded := path == "/api/login" || path == "/login" || path == "/api/logout"
+		isExcluded := path == "/api/login" || path == "/api/logout"
 
 		if (r.Method == http.MethodPost || r.Method == http.MethodPut || r.Method == http.MethodDelete) && !isExcluded {
-			headerToken := r.Header.Get("X-CSRF-Token")
-			if headerToken == "" || headerToken != token {
+			// Accept token from header (JS clients) or form field (HTML forms)
+			submittedToken := r.Header.Get("X-CSRF-Token")
+			if submittedToken == "" {
+				submittedToken = r.FormValue("csrf_token")
+			}
+			if submittedToken == "" || submittedToken != token {
 				http.Error(w, "CSRF token mismatch", http.StatusForbidden)
 				return
 			}