Require CSRF for browser mutations

Steps

Create the anonymous token for login, render it in a native form, and apply CSRF middleware before password verification. Login rotation invalidates the old token.

// Native form fragment; the controller supplied the current token.
<input type="hidden" name="csrf" value="<?= $e($csrf) ?>">

JSON requests send X-CSRF-Token; the AI endpoint accepts only JSON with scalar, closed input fields. Missing or stale proof yields 419, not a silent retry. Logout is POST, never an unsafe GET.

Verify

Test missing proof, array fields, rotated proof, unsupported media, and cross-session reuse. See Authentication and security.

Editorial provenance

Source: resources/guides/csrf.md. Source SHA-256: 5f7885c942748c40d8596157057a55f94c2821f14bb06e1b3d2a39ec8e136f39.

Knowledge-base application source; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.