authentication and security

app/templates/settings.html

@@ -169,7 +169,12 @@
         vnc: parseInt(document.getElementById('port-vnc').value, 10),
       }
     };
-    const res = await fetch('/api/settings', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) });
+    const headers = { 'Content-Type': 'application/json' };
+    const csrfToken = '{{ .CSRFToken }}';
+    if (csrfToken) {
+      headers['X-CSRF-Token'] = csrfToken;
+    }
+    const res = await fetch('/api/settings', { method: 'POST', headers: headers, body: JSON.stringify(payload) });
     const out = await res.json().catch(() => ({}));
     const el = document.getElementById('save-status');
     if (res.ok) {
@@ -181,10 +186,18 @@
     }
   }
   async function restartApp() {
-    const res = await fetch('/api/restart', { method: 'POST' });
+    const headers = {};
+    const csrfToken = '{{ .CSRFToken }}';
+    if (csrfToken) {
+      headers['X-CSRF-Token'] = csrfToken;
+    }
+    const res = await fetch('/api/restart', { method: 'POST', headers: headers });
     if (res.ok) {
       document.getElementById('save-status').textContent = 'Restarting...';
       setTimeout(() => location.reload(), 1200);
+    } else {
+      document.getElementById('save-status').textContent = 'Restart failed';
+      document.getElementById('save-status').className = 'text-sm text-red-400';
     }
   }
   document.getElementById('btn-save').addEventListener('click', saveSettings);