From ba619b818c01b033766485a106d759d1daf80aa0 Mon Sep 17 00:00:00 2001
From: Pulse Monitor <pulse@pulse-monitor.dev>
Date: Thu, 14 Aug 2025 09:34:54 +0000
Subject: [PATCH] fix: add CSRF token to export/import requests

- Export/import now includes X-CSRF-Token header from cookie
- Fixes 403 Forbidden error when exporting with session auth
- Both export and import endpoints now properly validate CSRF tokens
---
 .../src/components/Settings/Settings.tsx      | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/frontend-modern/src/components/Settings/Settings.tsx b/frontend-modern/src/components/Settings/Settings.tsx
index ae21be7ed..2d17865eb 100644
--- a/frontend-modern/src/components/Settings/Settings.tsx
+++ b/frontend-modern/src/components/Settings/Settings.tsx
@@ -561,10 +561,21 @@ const Settings: Component = () => {
     }
     
     try {
+      // Get CSRF token from cookie
+      const csrfToken = document.cookie
+        .split('; ')
+        .find(row => row.startsWith('pulse_csrf='))
+        ?.split('=')[1];
+      
       const headers: HeadersInit = {
         'Content-Type': 'application/json',
       };
       
+      // Add CSRF token if available
+      if (csrfToken) {
+        headers['X-CSRF-Token'] = csrfToken;
+      }
+      
       // Add API token if configured
       const apiToken = localStorage.getItem('apiToken');
       if (apiToken) {
@@ -659,10 +670,21 @@ const Settings: Component = () => {
         return;
       }
       
+      // Get CSRF token from cookie
+      const csrfToken = document.cookie
+        .split('; ')
+        .find(row => row.startsWith('pulse_csrf='))
+        ?.split('=')[1];
+      
       const headers: HeadersInit = {
         'Content-Type': 'application/json',
       };
       
+      // Add CSRF token if available
+      if (csrfToken) {
+        headers['X-CSRF-Token'] = csrfToken;
+      }
+      
       // Add API token if configured
       const apiToken = localStorage.getItem('apiToken');
       if (apiToken) {