From 21d7462b057838eb173145d79d2b9fd6c71e8053 Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Tue, 14 Oct 2025 11:46:56 -0700
Subject: Remove CSRF tokens

I think the built-in cross-origin protection will be good enough.
---
 templates/login.html.template | 1 -
 templates/note.html.template  | 1 -
 2 files changed, 2 deletions(-)

(limited to 'templates')

diff --git a/templates/login.html.template b/templates/login.html.template
index f08caf7..0cf3469 100644
--- a/templates/login.html.template
+++ b/templates/login.html.template
@@ -5,7 +5,6 @@
 		<p class="login-error">Incorrect password</p>
 	{{end}}
 	<form class="password-form" action="/login" method="post">
-		<input type="hidden" name="csrf-token" value="{{.CSRFToken}}">
 		<label class="password-label" for="password">Enter password</label>
 		<input id="password" class="password" type="password" name="password" autofocus>
 	</form>
diff --git a/templates/note.html.template b/templates/note.html.template
index 07c2d8e..19da416 100644
--- a/templates/note.html.template
+++ b/templates/note.html.template
@@ -6,7 +6,6 @@
 {{end}}
 
 <form id="form" method="post">
-	<input type="hidden" name="csrf-token" value="{{.CSRFToken}}">
 	<div class="save-indicator-container">
 		{{block "saveIndicator" ""}}
 			<span id="save-indicator">{{.}}</span>
-- 
cgit v1.3.1