From 455e90fb2798bdd47d85894e81f84517eb5a47e0 Mon Sep 17 00:00:00 2001
From: julien <julien.deb@netig.net>
Date: Thu, 22 Oct 2026 19:33:34 +0200
Subject: [PATCH] Enable global CSRF protection

---
 netig.rb          | 3 ++-
 routes/contact.rb | 2 --
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/netig.rb b/netig.rb
index 8c3e4ab..c836819 100644
--- a/netig.rb
+++ b/netig.rb
@@ -9,7 +9,7 @@ class Netig < Roda
   plugin :public
   plugin :default_headers, "Content-Type" => "text/html; charset=utf-8"
   plugin :sessions, secret: ENV.fetch("SESSION_SECRET")
-  plugin :route_csrf
+  plugin :route_csrf, csrf_failure: :empty_403
   plugin :hash_branches
   plugin :flash
 
@@ -17,6 +17,7 @@ class Netig < Roda
 
   route do |r|
     r.public
+    check_csrf!
     r.hash_branches
 
     r.root do
diff --git a/routes/contact.rb b/routes/contact.rb
index dd71b3d..638a050 100644
--- a/routes/contact.rb
+++ b/routes/contact.rb
@@ -11,8 +11,6 @@ class Netig
     end
 
     r.post "send" do
-      check_csrf!
-
       form = ContactForm.new(r.params)
 
       if form.spam?