.

cards/templates/cards/base.html

@@ -119,4 +119,29 @@
       }
     })();
   </script>
+  <script>
+    // Ensure HTMX requests include Django CSRF token (reads from cookie)
+    (function(){
+      function getCookie(name){
+        let cookieValue = null;
+        if (document.cookie && document.cookie !== ''){
+          const cookies = document.cookie.split(';');
+          for (let i=0;i<cookies.length;i++){
+            const cookie = cookies[i].trim();
+            if (cookie.substring(0, name.length + 1) === (name + '=')){
+              cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+              break;
+            }
+          }
+        }
+        return cookieValue;
+      }
+      document.body.addEventListener('htmx:configRequest', function(evt){
+        const csrftoken = getCookie('csrftoken');
+        if (csrftoken){
+          evt.detail.headers['X-CSRFToken'] = csrftoken;
+        }
+      });
+    })();
+  </script>
 </html>

templates/cards/base.html

@@ -119,4 +119,29 @@
       }
     })();
   </script>
+  <script>
+    // Ensure HTMX requests include Django CSRF token (reads from cookie)
+    (function(){
+      function getCookie(name){
+        let cookieValue = null;
+        if (document.cookie && document.cookie !== ''){
+          const cookies = document.cookie.split(';');
+          for (let i=0;i<cookies.length;i++){
+            const cookie = cookies[i].trim();
+            if (cookie.substring(0, name.length + 1) === (name + '=')){
+              cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+              break;
+            }
+          }
+        }
+        return cookieValue;
+      }
+      document.body.addEventListener('htmx:configRequest', function(evt){
+        const csrftoken = getCookie('csrftoken');
+        if (csrftoken){
+          evt.detail.headers['X-CSRFToken'] = csrftoken;
+        }
+      });
+    })();
+  </script>
 </html>