From ea1a629b1a275e28ddfadbaa66e2550b9ebe4383 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Sat, 29 Aug 2026 15:43:51 +0930
Subject: [PATCH] Add csrf-token meta to anon and app-guest layouts

These guest layouts also load app.js, which reads the csrf-token meta
tag to set the axios X-CSRF-TOKEN header. Without it, they logged the
same 'CSRF token not found' console error and had no CSRF header for
AJAX requests. Adds the meta tag to match the other layouts.
---
 resources/views/layouts/anon.blade.php      | 1 +
 resources/views/layouts/app-guest.blade.php | 1 +
 2 files changed, 2 insertions(+)

diff --git a/resources/views/layouts/anon.blade.php b/resources/views/layouts/anon.blade.php
index b3d350fa9..dd4a9d827 100644
--- a/resources/views/layouts/anon.blade.php
+++ b/resources/views/layouts/anon.blade.php
@@ -5,6 +5,7 @@
     <meta charset="utf-8">
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="csrf-token" content="{{ csrf_token() }}">
 
     <meta name="robots" content="noimageindex, noarchive">
     <meta name="mobile-web-app-capable" content="yes">
diff --git a/resources/views/layouts/app-guest.blade.php b/resources/views/layouts/app-guest.blade.php
index 7d8dbd201..88541c558 100644
--- a/resources/views/layouts/app-guest.blade.php
+++ b/resources/views/layouts/app-guest.blade.php
@@ -3,6 +3,7 @@
 	<meta charset="utf-8">
 	<meta http-equiv="X-UA-Compatible" content="IE=edge">
 	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+	<meta name="csrf-token" content="{{ csrf_token() }}">
 	<meta name="mobile-web-app-capable" content="yes">
 
 	<title>{{ $title ?? config_cache('app.name', 'Pixelfed') }}</title>