diff options
| author | Peter Stone <thepeterstone@gmail.com> | 2026-01-20 15:18:57 -1000 |
|---|---|---|
| committer | Peter Stone <thepeterstone@gmail.com> | 2026-01-20 15:18:57 -1000 |
| commit | 78e8f597ff28f1b8406f5cfbf934adc22abdf85b (patch) | |
| tree | f3b7dfff2c460e2d8752b61c131e80a73fa6b08d /web | |
| parent | 08bbcf18b1207153983261652b4a43a9b36f386c (diff) | |
Add CSRF protection and auth unit tests
Add CSRF token middleware for state-changing request protection,
integrate tokens into templates and HTMX headers, and add unit
tests for authentication service and handlers.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Diffstat (limited to 'web')
| -rw-r--r-- | web/templates/index.html | 3 | ||||
| -rw-r--r-- | web/templates/login.html | 1 |
2 files changed, 3 insertions, 1 deletions
diff --git a/web/templates/index.html b/web/templates/index.html index 54bb0c6..c270b48 100644 --- a/web/templates/index.html +++ b/web/templates/index.html @@ -6,7 +6,7 @@ <title>Personal Dashboard</title> <link rel="stylesheet" href="/static/css/output.css"> </head> -<body class="min-h-screen"> +<body class="min-h-screen" hx-headers='{"X-CSRF-Token": "{{.CSRFToken}}"}'> <div class="content-max-width py-8"> <!-- Header --> <header class="mb-8 flex flex-col sm:flex-row justify-between items-start sm:items-center gap-4"> @@ -20,6 +20,7 @@ <span id="refresh-text">Refresh</span> </button> <form method="POST" action="/logout" class="no-print"> + <input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <button type="submit" class="text-gray-600 hover:text-gray-900 px-3 py-2 rounded-lg transition-colors font-medium"> Logout diff --git a/web/templates/login.html b/web/templates/login.html index e5ce9e4..c865ce5 100644 --- a/web/templates/login.html +++ b/web/templates/login.html @@ -18,6 +18,7 @@ {{end}} <form method="POST" action="/login" class="space-y-6"> + <input type="hidden" name="csrf_token" value="{{.CSRFToken}}"> <div> <label for="username" class="block text-sm font-medium text-gray-700 mb-2"> Username |