1 Commits

Author	SHA1	Message	Date
opencode	bcae59626f	feat(security): add CSRF protection for all state-changing API routes ... - Synchronizer token stored in session; GET /auth/csrf to obtain it - csrfProtection middleware requires X-CSRF-Token on non-safe methods - customFetch injects the header via setCsrfTokenGetter - toolrate boot loads token; reload after local login (session regenerate) - OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated	2026-08-03 10:30:13 +02:00