From 2e459c911031669080bc110059cf2b4b19c5379d Mon Sep 17 00:00:00 2001 From: Adam Mathes Date: Mon, 16 Feb 2026 14:02:48 -0800 Subject: Enhance CSRF protection for login page Login form now includes a CSRF token from the cookie as a hidden form field. The CSRF middleware accepts tokens from either the X-CSRF-Token header (for JS clients) or the csrf_token form field (for HTML forms). Removed /login from the CSRF exclusion list so login POSTs are now validated. Co-Authored-By: Claude Opus 4.6 --- web/static/login.html | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'web/static/login.html') diff --git a/web/static/login.html b/web/static/login.html index c7d0a03..c469528 100644 --- a/web/static/login.html +++ b/web/static/login.html @@ -115,7 +115,8 @@