---
id: 14
title: Add CSRF protection to word-input form
status: done
priority: medium
created: 2026-07-17T03:57:20.699057952+02:00
updated: 2026-07-19T21:23:27.817959707+02:00
started: 2026-07-19T21:23:27.819406405+02:00
completed: 2026-07-19T21:23:27.819406405+02:00
tags:
    - security
claimed_by: rain-raven
claimed_at: 2026-07-19T21:23:27.817959707+02:00
class: standard
---

From framework review (docs/framework_review.md), P1-2. tpl/index.tpl POSTs to mode=display which writes session state and triggers image downloads. No CSRF token means a cross-site request can drive the machine. Fix: add session-bound CSRF token to the form, validate in ZAPDisplay.