diana.dolgolyova 6cbdba2197 feat: add CSRF protection for admin API routes ...

Double-submit cookie pattern: login sets bh-csrf-token cookie,
proxy.ts validates X-CSRF-Token header on POST/PUT/DELETE to /api/admin/*.
New adminFetch() helper in src/lib/csrf.ts auto-includes the header.
All admin pages migrated from fetch() to adminFetch().

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-17 17:53:02 +03:00

..

[id]

feat: add CSRF protection for admin API routes

2026-03-17 17:53:02 +03:00

page.tsx

feat: add CSRF protection for admin API routes

2026-03-17 17:53:02 +03:00