From 2a1571ef73a8185f8ec45819604cee52634e14b0 Mon Sep 17 00:00:00 2001
From: lokses <admin@lokses.od.ua>
Date: Wed, 16 Sep 2026 20:35:07 +0300
Subject: [PATCH] =?UTF-8?q?chat/htmx:=20CSRF-=D0=B7=D0=B0=D0=B3=D0=BE?=
 =?UTF-8?q?=D0=BB=D0=BE=D0=B2=D0=BE=D0=BA=20=D0=B4=D0=BB=D1=8F=20=D0=B2?=
 =?UTF-8?q?=D1=81=D0=B5=D1=85=20htmx-=D0=B7=D0=B0=D0=BF=D1=80=D0=BE=D1=81?=
 =?UTF-8?q?=D0=BE=D0=B2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hx-post вне формы (кнопка «Синхронизировать чат») слал POST без CSRF —
Forbidden (CSRF token missing). Добавил hx-headers с X-CSRFToken на <body>:
токен уходит со всеми htmx-запросами, работает и при CSRF_COOKIE_HTTPONLY.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 templates/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/index.html b/templates/index.html
index f8aa727..0e888a8 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -50,7 +50,7 @@
     <script src="{% static 'assets/js/chat.js' %}"></script>
     <script src="{% static 'assets/js/documents.js' %}"></script>
 </head>
-<body>
+<body hx-headers='{"X-CSRFToken": "{{ csrf_token }}"}'>
 
 <script>
     function isMobile() { return window.innerWidth < 768; }