global csrf

netig.rb

@@ -9,7 +9,7 @@ class Netig < Roda
   plugin :public
   plugin :default_headers, "Content-Type" => "text/html; charset=utf-8"
   plugin :sessions, secret: ENV.fetch("SESSION_SECRET")
-  plugin :route_csrf
+  plugin :route_csrf, csrf_failure: :empty_403
   plugin :hash_branches
   plugin :flash
 
@@ -17,6 +17,7 @@ class Netig < Roda
 
   route do |r|
     r.public
+    check_csrf!
     r.hash_branches
 
     r.root do