csrf fixes

src/main/resources/static/js/csrf.js

@@ -0,0 +1,37 @@
+document.addEventListener('DOMContentLoaded', function() {
+    // Get CSRF token from cookie
+    const getCsrfToken = () => {
+        return document.cookie
+            .split('; ')
+            .find(row => row.startsWith('XSRF-TOKEN='))
+            ?.split('=')[1];
+    };
+
+    // Function to decode the URI-encoded cookie value
+    const decodeCsrfToken = (token) => {
+        if (token) {
+            return decodeURIComponent(token);
+        }
+        return null;
+    };
+
+    // Find all forms and add CSRF token
+    const forms = document.querySelectorAll('form');
+    const csrfToken = decodeCsrfToken(getCsrfToken());
+
+    // Only proceed if we have a cookie-based token
+    if (csrfToken) {
+        forms.forEach(form => {
+            // Only now remove existing CSRF input fields since we have a new token
+            const existingCsrfInputs = form.querySelectorAll('input[name="_csrf"]');
+            existingCsrfInputs.forEach(input => input.remove());
+
+            // Create and add new CSRF input field
+            const csrfInput = document.createElement('input');
+            csrfInput.type = 'hidden';
+            csrfInput.name = '_csrf';
+            csrfInput.value = csrfToken;
+            form.appendChild(csrfInput);
+        });
+    }
+});

src/main/resources/templates/fragments/common.html

@@ -73,6 +73,7 @@
     <script th:src="@{'/js/cacheFormInputs.js'}"  th:if="${currentPage != 'home'}"></script>
     <script th:src="@{'/js/tab-container.js'}"></script>
     <script th:src="@{'/js/darkmode.js'}"></script>
+    <script th:src="@{'/js/csrf.js'}"></script>
     <script th:inline="javascript">
         const stirlingPDFLabel = /*[[${@StirlingPDFLabel}]]*/ '';
         const analyticsEnabled = /*[[${@analyticsEnabled}]]*/ false;