From 17f7563cb50a44757ed32c9b43b5529de01d93a3 Mon Sep 17 00:00:00 2001
From: Johan Cwiklinski <johan@x-tnd.be>
Date: Sat, 15 Aug 2026 08:32:26 +0200
Subject: [PATCH 1/2] Remove CSRF tokens from forms

---
 templates/default/oauth2_authorize.html.twig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/templates/default/oauth2_authorize.html.twig b/templates/default/oauth2_authorize.html.twig
index cab0d0a..e5e92bd 100755
--- a/templates/default/oauth2_authorize.html.twig
+++ b/templates/default/oauth2_authorize.html.twig
@@ -22,7 +22,6 @@
     {% endfor %}
                 <br/>
 
-                {% include "components/forms/csrf.html.twig" %}
 
                 <div class="ui two column grid">
                     <div class="column center aligned">

From 4a14a192124413598df9647226a16758409cbfdb Mon Sep 17 00:00:00 2001
From: Johan Cwiklinski <johan@x-tnd.be>
Date: Sat, 15 Aug 2026 08:32:36 +0200
Subject: [PATCH 2/2] Fix CSRF exclusions

---
 _define.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/_define.php b/_define.php
index c5bd2cd..4d53550 100644
--- a/_define.php
+++ b/_define.php
@@ -30,5 +30,5 @@
 );
 
 $this->setCsrfExclusions([
-    '/oauth2_*/',
+    '/oauth2_(token|user)/',
 ]);