adding enhanced csrf protection

2026-05-06 09:07:48 +02:00
parent 7ae7df0a11
commit d82a08f77b
25 changed files with 132 additions and 7 deletions
@@ -1,3 +1,7 @@
+<?php
+include "../api/utils/security.php";
+secure_session_start();
+?>
 <!DOCTYPE html>
 <html lang="en" data-bs-theme="dark">

@@ -7,6 +11,7 @@
    <title>Password Reset</title>
    <?php
    include "../assets/components.php";
+    print_csrf_script();
    ?>

 </head>
@@ -57,6 +62,9 @@
            try {
                const response = await fetch('/api/login/reset_pw.php', {
                    method: 'POST',
+                    headers: {
+                        'X-CSRF-Token': window.csrfToken
+                    },
                    body: formData
                });

@@ -79,4 +87,3 @@
 </body>

 </html>
-