No CSRF protection on state-changing endpoints #17

Severity: Medium
Location: internal/server/api.go:47-61, internal/auth/auth.go:76-79

The POST /api/tokens, DELETE /api/tokens/{id}, and POST /auth/logout endpoints rely on cookie-based authentication from the web UI but do not verify a CSRF token. The SameSite: Lax attribute on the cookie provides some protection (it blocks cross-site POST requests from forms in modern browsers), but this is not a complete defence:

• SameSite: Lax does not protect against same-site attacks (e.g., if any subdomain of the management host is compromised).
• Older browsers may not enforce SameSite correctly.

Recommendation

Add a synchronizer token pattern (CSRF token) or require a custom request header (e.g., X-GHP-Token) for all state-changing requests from the web UI. API requests using Authorization: Bearer headers are already immune to CSRF.