v0.5.173: OIDC state всегда, CSRF смонтирован, session.regenerate

views/v2/user.ejs

@@ -188,6 +188,7 @@
     <div class="card-header">Добавить адрес</div>
     <div class="card-body">
       <form method="POST" action="/v2/app/add">
+        <input type="hidden" name="_csrf" value="<%= csrfToken %>">
         <div class="form-grid">
           <div class="field">
             <label>IPv4 адрес или подсеть CIDR</label>
@@ -233,6 +234,7 @@
             <td style="text-align:center;white-space:nowrap;">
               <% if (!e.deleted_at) { %>
                 <form method="POST" action="/v2/app/edit/<%= e.id %>" style="display:inline;">
+                  <input type="hidden" name="_csrf" value="<%= csrfToken %>">
                   <input name="cidr" value="<%= e.value_cidr %>" size="18" style="width:125px;padding:.2rem .3rem;border:1px solid var(--border);border-radius:4px;font-size:.78rem;">
                   <input name="comment" value="<%= e.comment || '' %>" size="30" style="width:200px;padding:.2rem .3rem;border:1px solid var(--border);border-radius:4px;font-size:.78rem;">
                   <button class="btn btn-sm" title="Сохранить">💾</button>
@@ -244,11 +246,13 @@
             <td style="text-align:center;">
               <% if (!e.deleted_at) { %>
                 <form method="POST" action="/v2/app/delete/<%= e.id %>" style="display:inline;">
+                  <input type="hidden" name="_csrf" value="<%= csrfToken %>">
                   <input type="hidden" name="deleted" value="<%= includeDeleted ? '1' : '0' %>">
                   <button type="submit" class="btn btn-sm btn-danger" onclick="return confirm('Удалить?')" title="Удалить">🗑️</button>
                 </form>
               <% } else { %>
                 <form method="POST" action="/v2/app/restore/<%= e.id %>" style="display:inline;">
+                  <input type="hidden" name="_csrf" value="<%= csrfToken %>">
                   <input type="hidden" name="deleted" value="<%= includeDeleted ? '1' : '0' %>">
                   <button type="submit" class="btn btn-sm" title="Восстановить" style="color:var(--green);border-color:var(--green);">↺</button>
                 </form>