diff --git a/GanjooRazor/Areas/Admin/Pages/Banners.cshtml b/GanjooRazor/Areas/Admin/Pages/Banners.cshtml
index 3a1ad0b3..f8b2d6f3 100644
--- a/GanjooRazor/Areas/Admin/Pages/Banners.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/Banners.cshtml
@@ -19,6 +19,7 @@
 <div class="up-card">
     <h2 class="up-card__title">آگاهی جدید</h2>
     <form method="post" enctype="multipart/form-data" class="up-form">
+        @Html.AntiForgeryToken()
         <div class="up-field">
             <label for="Upload_Image">تصویر</label>
             <input type="file" asp-for="Upload.Image" />
diff --git a/GanjooRazor/Areas/Admin/Pages/Banners.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/Banners.cshtml.cs
index 74cba910..57c70e50 100644
--- a/GanjooRazor/Areas/Admin/Pages/Banners.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/Banners.cshtml.cs
@@ -12,7 +12,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class BannersModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/CatDel.cshtml b/GanjooRazor/Areas/Admin/Pages/CatDel.cshtml
index 0f2c4649..f54b0f9f 100644
--- a/GanjooRazor/Areas/Admin/Pages/CatDel.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/CatDel.cshtml
@@ -28,6 +28,7 @@ else
         <tr>
             <td>
                 <form method="post" action="/Admin/CatDel?id=@Model.Cat.Cat.Id">
+                    @Html.AntiForgeryToken()
                     <input type="submit" value="بله" />
                 </form>
             </td>
diff --git a/GanjooRazor/Areas/Admin/Pages/CatDel.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/CatDel.cshtml.cs
index 25b8f298..9fe83355 100644
--- a/GanjooRazor/Areas/Admin/Pages/CatDel.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/CatDel.cshtml.cs
@@ -9,7 +9,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class CatDelModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/CatTrans.cshtml b/GanjooRazor/Areas/Admin/Pages/CatTrans.cshtml
index 594bfc84..843d2c47 100644
--- a/GanjooRazor/Areas/Admin/Pages/CatTrans.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/CatTrans.cshtml
@@ -93,6 +93,7 @@ else
         <div class="up-field">
             <label for="DestCatId">مشابه‌یابی در بخش</label>
             <form method="post" action="/Admin/CatTrans?Handler=FindDuplicates&id=@Model.CatId" class="up-form-actions">
+                @Html.AntiForgeryToken()
                 <input asp-for="DestCatId" style="flex:1;" />
                 <input type="submit" value="شروع مشابه‌یابی" class="up-btn up-btn--ghost" />
             </form>
@@ -103,6 +104,7 @@ else
         <div class="up-field">
             <label for="DestCatId">نهایی‌سازی انتقال به بخش</label>
             <form method="post" action="/Admin/CatTrans?Handler=Finalize&id=@Model.CatId" class="up-form-actions">
+                @Html.AntiForgeryToken()
                 <input asp-for="DestCatId" style="flex:1;" />
                 <input type="submit" value="نهایی سازی" class="up-btn up-btn--success" />
             </form>
diff --git a/GanjooRazor/Areas/Admin/Pages/CatTrans.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/CatTrans.cshtml.cs
index adc4022f..d5635920 100644
--- a/GanjooRazor/Areas/Admin/Pages/CatTrans.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/CatTrans.cshtml.cs
@@ -15,7 +15,6 @@ using RMuseum.Models.Ganjoor.ViewModels;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class CatTransModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/CatUtils.cshtml b/GanjooRazor/Areas/Admin/Pages/CatUtils.cshtml
index 14b54a7e..d10c87f1 100644
--- a/GanjooRazor/Areas/Admin/Pages/CatUtils.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/CatUtils.cshtml
@@ -484,6 +484,7 @@
 }
 
 <form method="post">
+    @Html.AntiForgeryToken()
     <table>
         <tr>
             <td>
@@ -643,6 +644,7 @@
 </table>
 
 <form method="post" action="?Handler=Numbering&url=@Model.Cat.Cat.FullUrl">
+    @Html.AntiForgeryToken()
     <table>
         <tr>
             <td>
@@ -678,6 +680,7 @@
 
 <h2>ابرداده‌های دیگر بخش</h2>
 <form method="post" action="?Handler=UpdateCatMeta&url=@Model.Cat.Cat.FullUrl">
+    @Html.AntiForgeryToken()
     <table>
         <tr>
             <td>
@@ -725,6 +728,7 @@
         <td>بارگذاری پایگاه داده‌ها شامل یک دسته‌بندی از اشعار:</td>
         <td>
             <form method="post" enctype="multipart/form-data" action="/Admin/CatUtils?Handler=UploadDb&url=@Model.Cat.Cat.FullUrl">
+                @Html.AntiForgeryToken()
                 <input type="file" asp-for="SQLiteDb" />
                 <input type="submit" value="بارگذاری" class="up-btn up-btn--success" />
             </form>
diff --git a/GanjooRazor/Areas/Admin/Pages/CatUtils.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/CatUtils.cshtml.cs
index 4bea67da..3bac265f 100644
--- a/GanjooRazor/Areas/Admin/Pages/CatUtils.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/CatUtils.cshtml.cs
@@ -14,7 +14,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class CatUtilsModel : GanjoorPageModelBase
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/DonationEdit.cshtml b/GanjooRazor/Areas/Admin/Pages/DonationEdit.cshtml
index 75c8e7c2..8b6644ec 100644
--- a/GanjooRazor/Areas/Admin/Pages/DonationEdit.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/DonationEdit.cshtml
@@ -15,6 +15,7 @@
 @if (Model.Donation != null)
 {
     <form method="post">
+        @Html.AntiForgeryToken()
 
         <table>
             <tr>
diff --git a/GanjooRazor/Areas/Admin/Pages/DonationEdit.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/DonationEdit.cshtml.cs
index 5233dbd1..dd9e5daf 100644
--- a/GanjooRazor/Areas/Admin/Pages/DonationEdit.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/DonationEdit.cshtml.cs
@@ -9,7 +9,6 @@ using RMuseum.Models.Accounting.ViewModels;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class DonationEditModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/Donations.cshtml b/GanjooRazor/Areas/Admin/Pages/Donations.cshtml
index ea354de9..f6b9a8e7 100644
--- a/GanjooRazor/Areas/Admin/Pages/Donations.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/Donations.cshtml
@@ -27,6 +27,7 @@
     <div class="up-card">
         <h2 class="up-card__title">کمک مالی جدید</h2>
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <div class="up-field">
                 <label asp-for="Donation.RecordDate">تاریخ</label>
                 <input type="date" asp-for="Donation.RecordDate" />
diff --git a/GanjooRazor/Areas/Admin/Pages/Donations.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/Donations.cshtml.cs
index 715330d7..0259faf7 100644
--- a/GanjooRazor/Areas/Admin/Pages/Donations.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/Donations.cshtml.cs
@@ -13,7 +13,6 @@ using RMuseum.Utils;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class DonationsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/EditQuoted.cshtml b/GanjooRazor/Areas/Admin/Pages/EditQuoted.cshtml
index 9af2e8d6..9bdb7b13 100644
--- a/GanjooRazor/Areas/Admin/Pages/EditQuoted.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/EditQuoted.cshtml
@@ -230,6 +230,7 @@
     </script>
     <div class="up-card">
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <p>
                 بیت مرجع از <a href="/?p=@Model.GanjoorQuotedPoem.PoemId">شعر</a>:
                 <input type="hidden" asp-for="GanjoorQuotedPoem.Id" />
diff --git a/GanjooRazor/Areas/Admin/Pages/EditQuoted.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/EditQuoted.cshtml.cs
index 7da77602..c79a3e9f 100644
--- a/GanjooRazor/Areas/Admin/Pages/EditQuoted.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/EditQuoted.cshtml.cs
@@ -15,7 +15,6 @@ using System.Net;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class EditQuotedModel : PageModel
     {
         public string LastMessage { get; set; }
diff --git a/GanjooRazor/Areas/Admin/Pages/ExpenseEdit.cshtml b/GanjooRazor/Areas/Admin/Pages/ExpenseEdit.cshtml
index aa224ff4..d8ad8c5a 100644
--- a/GanjooRazor/Areas/Admin/Pages/ExpenseEdit.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/ExpenseEdit.cshtml
@@ -12,6 +12,7 @@
 @if (Model.Expense != null)
 {
     <form method="post">
+        @Html.AntiForgeryToken()
 
         <table>
             <tr>
diff --git a/GanjooRazor/Areas/Admin/Pages/ExpenseEdit.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/ExpenseEdit.cshtml.cs
index 43eb6ed6..ab7f1476 100644
--- a/GanjooRazor/Areas/Admin/Pages/ExpenseEdit.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/ExpenseEdit.cshtml.cs
@@ -10,7 +10,6 @@ using RMuseum.Models.Accounting.ViewModels;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ExpenseEditModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/Expenses.cshtml b/GanjooRazor/Areas/Admin/Pages/Expenses.cshtml
index 1e20177c..073a3fdb 100644
--- a/GanjooRazor/Areas/Admin/Pages/Expenses.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/Expenses.cshtml
@@ -17,6 +17,7 @@
 <div class="up-card">
     <h2 class="up-card__title">هزینهٔ جدید</h2>
     <form method="post" class="up-form">
+        @Html.AntiForgeryToken()
         <div class="up-field">
             <label asp-for="Expense.ExpenseDate">تاریخ</label>
             <input type="date" asp-for="Expense.ExpenseDate" />
diff --git a/GanjooRazor/Areas/Admin/Pages/Expenses.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/Expenses.cshtml.cs
index 14341ec9..6b88c63d 100644
--- a/GanjooRazor/Areas/Admin/Pages/Expenses.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/Expenses.cshtml.cs
@@ -10,7 +10,6 @@ using RMuseum.Models.Accounting;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ExpensesModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/KickoutUser.cshtml b/GanjooRazor/Areas/Admin/Pages/KickoutUser.cshtml
index 47b3fea4..2ea9f107 100644
--- a/GanjooRazor/Areas/Admin/Pages/KickoutUser.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/KickoutUser.cshtml
@@ -33,6 +33,7 @@ else
         <tr>
             <td>
                 <form method="post">
+                    @Html.AntiForgeryToken()
                     <input type="hidden" asp-for="UserCauseViewModel.UserId" />
                     <table>
                         <tr>
diff --git a/GanjooRazor/Areas/Admin/Pages/KickoutUser.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/KickoutUser.cshtml.cs
index 1a0e5727..98b1cec3 100644
--- a/GanjooRazor/Areas/Admin/Pages/KickoutUser.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/KickoutUser.cshtml.cs
@@ -10,7 +10,6 @@ using RSecurityBackend.Models.Auth.ViewModels;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class KickoutUserModel : PageModel
     {
         public PublicRAppUser UserInfo { get; set; }
diff --git a/GanjooRazor/Areas/Admin/Pages/Locations.cshtml b/GanjooRazor/Areas/Admin/Pages/Locations.cshtml
index 2a5150ca..48a45539 100644
--- a/GanjooRazor/Areas/Admin/Pages/Locations.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/Locations.cshtml
@@ -28,6 +28,7 @@
 <div class="up-card">
     <h2 class="up-card__title">خاستگاه جدید</h2>
     <form method="post" class="up-form">
+        @Html.AntiForgeryToken()
         <div class="up-field">
             <label for="Location_Name">نام</label>
             <input asp-for="Location.Name" />
diff --git a/GanjooRazor/Areas/Admin/Pages/Locations.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/Locations.cshtml.cs
index bd120c25..b1e0530b 100644
--- a/GanjooRazor/Areas/Admin/Pages/Locations.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/Locations.cshtml.cs
@@ -8,7 +8,6 @@ using System.Text;
 using System.Threading.Tasks;
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class LocationsModel : PageModel
     {
         public string LastMessage { get; set; }
diff --git a/GanjooRazor/Areas/Admin/Pages/LongRunningJobs.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/LongRunningJobs.cshtml.cs
index 70b6064a..aec3a417 100644
--- a/GanjooRazor/Areas/Admin/Pages/LongRunningJobs.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/LongRunningJobs.cshtml.cs
@@ -9,7 +9,6 @@ using RSecurityBackend.Models.Generic.Db;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class LongRunningJobsModel : PageModel
     {
         public RLongRunningJobStatus[] Jobs { get; set; }
diff --git a/GanjooRazor/Areas/Admin/Pages/ModifyPage.cshtml b/GanjooRazor/Areas/Admin/Pages/ModifyPage.cshtml
index 47514d23..64435560 100644
--- a/GanjooRazor/Areas/Admin/Pages/ModifyPage.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/ModifyPage.cshtml
@@ -41,6 +41,7 @@
 
     <div class="up-card">
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <div class="up-field">
                 <label>شناسهٔ صفحه</label>
                 <div class="up-field-static"><a href="/?p=@Request.Query["id"]">@Request.Query["id"]</a></div>
@@ -181,6 +182,7 @@
 
     <div class="up-card">
         <form action="?Handler=GenerateCatPage&id=@Model.PageInformation.Id" method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <div class="up-field">
                 <label asp-for="GanjoorTOC">تولید فهرست</label>
                 <select asp-for="GanjoorTOC">
diff --git a/GanjooRazor/Areas/Admin/Pages/ModifyPage.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/ModifyPage.cshtml.cs
index ae9a2a25..b9473b4b 100644
--- a/GanjooRazor/Areas/Admin/Pages/ModifyPage.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/ModifyPage.cshtml.cs
@@ -15,7 +15,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ModifyPageModel : PageModel
     {
 
diff --git a/GanjooRazor/Areas/Admin/Pages/PageDel.cshtml b/GanjooRazor/Areas/Admin/Pages/PageDel.cshtml
index 231d2f5a..69ab6592 100644
--- a/GanjooRazor/Areas/Admin/Pages/PageDel.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/PageDel.cshtml
@@ -28,6 +28,7 @@ else
         <tr>
             <td>
                 <form method="post" action="/Admin/PageDel?id=@Model.PageInformation.Id">
+                    @Html.AntiForgeryToken()
                     <input type="submit" value="بله" />
                 </form>
             </td>
diff --git a/GanjooRazor/Areas/Admin/Pages/PageDel.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/PageDel.cshtml.cs
index 13d2ab8e..17d0f520 100644
--- a/GanjooRazor/Areas/Admin/Pages/PageDel.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/PageDel.cshtml.cs
@@ -9,7 +9,6 @@ using RMuseum.Models.Ganjoor.ViewModels;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class PageDelModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/Poet.cshtml b/GanjooRazor/Areas/Admin/Pages/Poet.cshtml
index ed5bb6ec..e5dadf26 100644
--- a/GanjooRazor/Areas/Admin/Pages/Poet.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/Poet.cshtml
@@ -17,6 +17,7 @@
 else
 {
     <form method="post" action="/Admin/Poet/?Handler=EditPoet&id=@Model.Poet.Id">
+        @Html.AntiForgeryToken()
 
         <table>
             <tr>
@@ -111,6 +112,7 @@ else
             <td>تصویر جدید:</td>
             <td>
                 <form method="post" enctype="multipart/form-data" action="/Admin/Poet/?Handler=UploadImage&id=@Model.Poet.Id">
+                    @Html.AntiForgeryToken()
                     <input type="file" asp-for="Image" />
                     <input type="submit" value="بارگذاری" />
                 </form>
@@ -132,6 +134,7 @@ else
             <td>بارگذاری پایگاه داده‌ها:</td>
             <td>
                 <form method="post" enctype="multipart/form-data" action="/Admin/Poet/?Handler=UploadDb&id=@Model.Poet.Id">
+                    @Html.AntiForgeryToken()
                     <input type="file" asp-for="SQLiteDb" />
                     <input type="submit" value="بارگذاری" />
                 </form>
@@ -144,6 +147,7 @@ else
             <td>تصحیح از طریق پایگاه داده‌ها:</td>
             <td>
                 <form method="post" enctype="multipart/form-data" action="/Admin/Poet/?Handler=UploadCorrectionDb&id=@Model.Poet.Id">
+                    @Html.AntiForgeryToken()
                     <input type="file" asp-for="CorrecionDbModel.Db" />
                     <input asp-for="CorrecionDbModel.Note" size="50" />
                     <input type="submit" value="بارگذاری" />
diff --git a/GanjooRazor/Areas/Admin/Pages/Poet.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/Poet.cshtml.cs
index de77cc82..90d2a985 100644
--- a/GanjooRazor/Areas/Admin/Pages/Poet.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/Poet.cshtml.cs
@@ -15,7 +15,6 @@ using RMuseum.Services.Implementation.ImportedFromDesktopGanjoor;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class PoetModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/PoetDel.cshtml b/GanjooRazor/Areas/Admin/Pages/PoetDel.cshtml
index 34b9c1a8..c3b7100e 100644
--- a/GanjooRazor/Areas/Admin/Pages/PoetDel.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/PoetDel.cshtml
@@ -28,6 +28,7 @@ else
         <tr>
             <td>
                 <form method="post">
+                    @Html.AntiForgeryToken()
                     <input type="submit" value="بله" />
                 </form>
             </td>
diff --git a/GanjooRazor/Areas/Admin/Pages/PoetDel.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/PoetDel.cshtml.cs
index 167bbd2b..24a3b5cc 100644
--- a/GanjooRazor/Areas/Admin/Pages/PoetDel.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/PoetDel.cshtml.cs
@@ -10,7 +10,6 @@ using RMuseum.Models.Ganjoor.ViewModels;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class PoetDelModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/Poets.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/Poets.cshtml.cs
index c3f612cd..8cf4bc32 100644
--- a/GanjooRazor/Areas/Admin/Pages/Poets.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/Poets.cshtml.cs
@@ -12,7 +12,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class PoetsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/PublicDataImport.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/PublicDataImport.cshtml.cs
index 7328c81c..e9829db0 100644
--- a/GanjooRazor/Areas/Admin/Pages/PublicDataImport.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/PublicDataImport.cshtml.cs
@@ -13,7 +13,6 @@ namespace GanjooRazor.Areas.Admin.Pages
     /// (e.g. jsDelivr) — mainly meant to make setting up a fork or local dev copy easier than the
     /// old per-poet SQLite import.
     /// </summary>
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class PublicDataImportModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/ReviewCatEdits.cshtml b/GanjooRazor/Areas/Admin/Pages/ReviewCatEdits.cshtml
index 9b0f3844..c4fb22aa 100644
--- a/GanjooRazor/Areas/Admin/Pages/ReviewCatEdits.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/ReviewCatEdits.cshtml
@@ -174,6 +174,7 @@
     <div class="up-form-actions">
         <a role="button" id="moderatecorrections" class="up-btn up-btn--success" onclick="moderateCorrections(@Model.Correction.Id)">بررسی</a>
         <form method="post">
+            @Html.AntiForgeryToken()
             <button type="submit" name="next" id="next" class="up-btn up-btn--ghost">بعدی</button>
         </form>
     </div>
diff --git a/GanjooRazor/Areas/Admin/Pages/ReviewCatEdits.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/ReviewCatEdits.cshtml.cs
index bf2dc43a..7a1ef5fd 100644
--- a/GanjooRazor/Areas/Admin/Pages/ReviewCatEdits.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/ReviewCatEdits.cshtml.cs
@@ -17,7 +17,6 @@ using GanjooRazor.Models;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ReviewCatEditsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/ReviewEdits.cshtml b/GanjooRazor/Areas/Admin/Pages/ReviewEdits.cshtml
index b47a1320..f928da7c 100644
--- a/GanjooRazor/Areas/Admin/Pages/ReviewEdits.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/ReviewEdits.cshtml
@@ -234,6 +234,7 @@ else
             </td>
             <td>
                 <form method="post">
+                    @Html.AntiForgeryToken()
                     <button type="submit" name="next" id="next" class="up-btn up-btn--ghost up-btn--block">بعدی</button>
                 </form>
             </td>
@@ -937,7 +938,6 @@ else
                                     <input type="text" id="geotag@(geoIndex)_latitude" name="geotag@(geoIndex)_latitude" value="@geoTag.SuggestedLatitude" size="12" />
                                     <label for="geotag@(geoIndex)_longitude">طول جغرافیایی اصلاح‌شده:</label>
                                     <input type="text" id="geotag@(geoIndex)_longitude" name="geotag@(geoIndex)_longitude" value="@geoTag.SuggestedLongitude" size="12" />
-                                    <a role="button" class="up-btn up-btn--ghost up-btn--sm" onclick="viewLocation($('#geotag@(geoIndex)_latitude').val(), $('#geotag@(geoIndex)_longitude').val())">🗺️ مشاهده در نقشه</a>
                                 </div>
                             }
                         </td>
@@ -946,7 +946,7 @@ else
                 <tr>
                     <td colspan="2">
                         <div class="up-radio-option">
-<input type="radio" id="geotag@(geoIndex)_review_result_Approved" name="geotag@(geoIndex)_review_result" class="radio-approved" value="@RMuseum.Models.Ganjoor.CorrectionReviewResult.Approved" checked="checked">
+<input type="radio" id="geotag@(geoIndex)_review_result_Approved" name="geotag@(geoIndex)_review_result" class="radio-approved" value="@RMuseum.Models.Ganjoor.CorrectionReviewResult.Approved">
 <label for="geotag@(geoIndex)_review_result_Approved">@RMuseum.Services.Implementation.CorrectionReviewResultConvertor.GetString(RMuseum.Models.Ganjoor.CorrectionReviewResult.Approved)</label>
 </div>
                         <div class="up-radio-option">
@@ -958,7 +958,7 @@ else
 <label for="geotag@(geoIndex)_review_result_RejectedBecauseUnnecessaryChange">تغییر سلیقه‌ای یا بی دلیل است</label>
 </div>
                         <div class="up-radio-option">
-<input type="radio" id="geotag@(geoIndex)_review_result_Rejected" name="geotag@(geoIndex)_review_result" class="radio-rejected" value="@RMuseum.Models.Ganjoor.CorrectionReviewResult.Rejected">
+<input type="radio" id="geotag@(geoIndex)_review_result_Rejected" name="geotag@(geoIndex)_review_result" class="radio-rejected" value="@RMuseum.Models.Ganjoor.CorrectionReviewResult.Rejected" checked="checked">
 <label for="geotag@(geoIndex)_review_result_Rejected">@RMuseum.Services.Implementation.CorrectionReviewResultConvertor.GetString(RMuseum.Models.Ganjoor.CorrectionReviewResult.Rejected)</label>
 </div>
                         <input type="text" id="geotag@(geoIndex)_review_note" name="geotag@(geoIndex)_review_note" value="" size="50" />
diff --git a/GanjooRazor/Areas/Admin/Pages/ReviewEdits.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/ReviewEdits.cshtml.cs
index 02746089..1a8a4f21 100644
--- a/GanjooRazor/Areas/Admin/Pages/ReviewEdits.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/ReviewEdits.cshtml.cs
@@ -17,7 +17,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ReviewEditsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/ReviewPartEdits.cshtml b/GanjooRazor/Areas/Admin/Pages/ReviewPartEdits.cshtml
index 8479d1aa..b86946ae 100644
--- a/GanjooRazor/Areas/Admin/Pages/ReviewPartEdits.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/ReviewPartEdits.cshtml
@@ -518,6 +518,7 @@ else
         <div class="up-form-actions">
             <a role="button" id="moderatecorrections" class="up-btn up-btn--success" onclick="moderateSectionCorrections(@Model.Correction.Id, @Model.Verses.Count)">بررسی</a>
             <form method="post">
+                @Html.AntiForgeryToken()
                 <button type="submit" name="next" id="next" class="up-btn up-btn--ghost">بعدی</button>
             </form>
         </div>
diff --git a/GanjooRazor/Areas/Admin/Pages/ReviewPartEdits.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/ReviewPartEdits.cshtml.cs
index 8d39deba..0fedc71e 100644
--- a/GanjooRazor/Areas/Admin/Pages/ReviewPartEdits.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/ReviewPartEdits.cshtml.cs
@@ -15,7 +15,6 @@ using System.Collections.Generic;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ReviewPartEditsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/ReviewQuoteds.cshtml b/GanjooRazor/Areas/Admin/Pages/ReviewQuoteds.cshtml
index 82332b4b..48100b43 100644
--- a/GanjooRazor/Areas/Admin/Pages/ReviewQuoteds.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/ReviewQuoteds.cshtml
@@ -28,6 +28,7 @@ else
         </div>
 
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <input type="hidden" asp-for="ModerationModel.Id" />
             <div class="up-field">
                 <label asp-for="ModerationModel.Approved">تأیید می‌شود؟</label>
diff --git a/GanjooRazor/Areas/Admin/Pages/ReviewQuoteds.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/ReviewQuoteds.cshtml.cs
index e49399d5..8ae2d555 100644
--- a/GanjooRazor/Areas/Admin/Pages/ReviewQuoteds.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/ReviewQuoteds.cshtml.cs
@@ -16,7 +16,6 @@ using RMuseum.Models.Auth.ViewModel;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ReviewQuotedsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/Roles.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/Roles.cshtml.cs
index 97a4e7b0..b984fb8b 100644
--- a/GanjooRazor/Areas/Admin/Pages/Roles.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/Roles.cshtml.cs
@@ -11,7 +11,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class RolesModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/SectionDel.cshtml b/GanjooRazor/Areas/Admin/Pages/SectionDel.cshtml
index c4c687f1..575e3f6d 100644
--- a/GanjooRazor/Areas/Admin/Pages/SectionDel.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/SectionDel.cshtml
@@ -28,6 +28,7 @@ else
         <tr>
             <td>
                 <form method="post">
+                    @Html.AntiForgeryToken()
                     <input type="submit" value="بله" />
                 </form>
             </td>
diff --git a/GanjooRazor/Areas/Admin/Pages/SectionDel.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/SectionDel.cshtml.cs
index a1ea4776..95fd9914 100644
--- a/GanjooRazor/Areas/Admin/Pages/SectionDel.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/SectionDel.cshtml.cs
@@ -8,7 +8,6 @@ using System.Threading.Tasks;
 namespace GanjooRazor.Areas.Admin.Pages
 {
 
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class SectionDelModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/SpotifyCallback.cshtml b/GanjooRazor/Areas/Admin/Pages/SpotifyCallback.cshtml
index f36b4be1..b0c88343 100644
--- a/GanjooRazor/Areas/Admin/Pages/SpotifyCallback.cshtml
+++ b/GanjooRazor/Areas/Admin/Pages/SpotifyCallback.cshtml
@@ -10,6 +10,7 @@
 @if (ViewData.ContainsKey("ganjoor-songrevu"))
 {
     <form method="post">
+        @Html.AntiForgeryToken()
         <input asp-for="@Model.Code" type="hidden" />
 
 
diff --git a/GanjooRazor/Areas/Admin/Pages/SpotifyCallback.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/SpotifyCallback.cshtml.cs
index 0a6f7fab..65e836cf 100644
--- a/GanjooRazor/Areas/Admin/Pages/SpotifyCallback.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/SpotifyCallback.cshtml.cs
@@ -12,7 +12,6 @@ using Newtonsoft.Json.Linq;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class SpotifyCallbackModel : PageModel
     {
         public SpotifyCallbackModel(IHttpClientFactory clientFactory, IConfiguration configuration)
diff --git a/GanjooRazor/Areas/Admin/Pages/TransferMeter.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/TransferMeter.cshtml.cs
index 71fd5f18..c49449eb 100644
--- a/GanjooRazor/Areas/Admin/Pages/TransferMeter.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/TransferMeter.cshtml.cs
@@ -10,7 +10,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class TransferMeterModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/Admin/Pages/Users.cshtml.cs b/GanjooRazor/Areas/Admin/Pages/Users.cshtml.cs
index 6b8d3687..d350e5a3 100644
--- a/GanjooRazor/Areas/Admin/Pages/Users.cshtml.cs
+++ b/GanjooRazor/Areas/Admin/Pages/Users.cshtml.cs
@@ -15,7 +15,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.Admin.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class UsersModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/AddSong.cshtml b/GanjooRazor/Areas/User/Pages/AddSong.cshtml
index 9bff66ac..293f773d 100644
--- a/GanjooRazor/Areas/User/Pages/AddSong.cshtml
+++ b/GanjooRazor/Areas/User/Pages/AddSong.cshtml
@@ -17,6 +17,7 @@
 
 <div class="up-card">
     <form method="post" class="up-form">
+        @Html.AntiForgeryToken()
         <div class="up-field">
             <label asp-for="PoemMusicTrackViewModel.PoemId">شناسهٔ شعر</label>
             <input asp-for="PoemMusicTrackViewModel.PoemId" />
diff --git a/GanjooRazor/Areas/User/Pages/AddSong.cshtml.cs b/GanjooRazor/Areas/User/Pages/AddSong.cshtml.cs
index f44295af..6a329881 100644
--- a/GanjooRazor/Areas/User/Pages/AddSong.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/AddSong.cshtml.cs
@@ -9,7 +9,6 @@ using RMuseum.Models.Ganjoor.ViewModels;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class AddSongModel : PageModel
     {
 
diff --git a/GanjooRazor/Areas/User/Pages/AllPoemSections.cshtml.cs b/GanjooRazor/Areas/User/Pages/AllPoemSections.cshtml.cs
index 2f802599..37b4b08c 100644
--- a/GanjooRazor/Areas/User/Pages/AllPoemSections.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/AllPoemSections.cshtml.cs
@@ -9,7 +9,6 @@ using RMuseum.Models.Ganjoor;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class AllPoemSectionsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/AwaitingComments.cshtml.cs b/GanjooRazor/Areas/User/Pages/AwaitingComments.cshtml.cs
index 82363453..ebc46196 100644
--- a/GanjooRazor/Areas/User/Pages/AwaitingComments.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/AwaitingComments.cshtml.cs
@@ -16,7 +16,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class AwaitingCommentsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/CatEditor.cshtml b/GanjooRazor/Areas/User/Pages/CatEditor.cshtml
index f90619a4..68b37b75 100644
--- a/GanjooRazor/Areas/User/Pages/CatEditor.cshtml
+++ b/GanjooRazor/Areas/User/Pages/CatEditor.cshtml
@@ -93,6 +93,7 @@
 
 <div class="up-card">
     <form method="post" class="up-form">
+        @Html.AntiForgeryToken()
         @if (Model.PageInformation != null)
         {
             <p><a role="button" target="_blank" href="@Model.PageInformation.FullUrl" class="up-btn up-btn--ghost">@Model.PageInformation.FullTitle</a></p>
diff --git a/GanjooRazor/Areas/User/Pages/CatEditor.cshtml.cs b/GanjooRazor/Areas/User/Pages/CatEditor.cshtml.cs
index dc89e5dc..b8523456 100644
--- a/GanjooRazor/Areas/User/Pages/CatEditor.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/CatEditor.cshtml.cs
@@ -12,7 +12,6 @@ using RMuseum.Utils;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class CatEditorModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/CatEdits.cshtml.cs b/GanjooRazor/Areas/User/Pages/CatEdits.cshtml.cs
index bcbb3b27..cb732be8 100644
--- a/GanjooRazor/Areas/User/Pages/CatEdits.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/CatEdits.cshtml.cs
@@ -14,7 +14,6 @@ using System.Linq;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class CatEditsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/DeleteAccount.cshtml.cs b/GanjooRazor/Areas/User/Pages/DeleteAccount.cshtml.cs
index 459b92b8..3e4d3b25 100644
--- a/GanjooRazor/Areas/User/Pages/DeleteAccount.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/DeleteAccount.cshtml.cs
@@ -12,7 +12,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class DeleteAccountModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/Editor.cshtml.cs b/GanjooRazor/Areas/User/Pages/Editor.cshtml.cs
index c83d2d2c..d97b8b79 100644
--- a/GanjooRazor/Areas/User/Pages/Editor.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/Editor.cshtml.cs
@@ -14,7 +14,6 @@ using RMuseum.Models.Ganjoor.ViewModels;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class EditorModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/Edits.cshtml.cs b/GanjooRazor/Areas/User/Pages/Edits.cshtml.cs
index 3cce5365..3268de44 100644
--- a/GanjooRazor/Areas/User/Pages/Edits.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/Edits.cshtml.cs
@@ -18,7 +18,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class EditsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/FAQCatEdit.cshtml b/GanjooRazor/Areas/User/Pages/FAQCatEdit.cshtml
index bdc2e423..e62ed11d 100644
--- a/GanjooRazor/Areas/User/Pages/FAQCatEdit.cshtml
+++ b/GanjooRazor/Areas/User/Pages/FAQCatEdit.cshtml
@@ -17,6 +17,7 @@
 else
 {
     <form method="post">
+        @Html.AntiForgeryToken()
         <table>
             <tr>
                 <td>
diff --git a/GanjooRazor/Areas/User/Pages/FAQCatEdit.cshtml.cs b/GanjooRazor/Areas/User/Pages/FAQCatEdit.cshtml.cs
index fbb7820e..8945f04e 100644
--- a/GanjooRazor/Areas/User/Pages/FAQCatEdit.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/FAQCatEdit.cshtml.cs
@@ -10,7 +10,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class FAQCatEditModel : PageModel
     {
         [BindProperty]
diff --git a/GanjooRazor/Areas/User/Pages/FAQItemEdit.cshtml b/GanjooRazor/Areas/User/Pages/FAQItemEdit.cshtml
index 7d2a321f..a5744ce5 100644
--- a/GanjooRazor/Areas/User/Pages/FAQItemEdit.cshtml
+++ b/GanjooRazor/Areas/User/Pages/FAQItemEdit.cshtml
@@ -16,6 +16,7 @@
 else
 {
     <form method="post">
+        @Html.AntiForgeryToken()
         <table class="width-100per max-width-none">
             <tr>
                 <td>
diff --git a/GanjooRazor/Areas/User/Pages/FAQItemEdit.cshtml.cs b/GanjooRazor/Areas/User/Pages/FAQItemEdit.cshtml.cs
index d9b25338..40b62e3b 100644
--- a/GanjooRazor/Areas/User/Pages/FAQItemEdit.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/FAQItemEdit.cshtml.cs
@@ -10,7 +10,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class FAQItemEditModel : PageModel
     {
         [BindProperty]
diff --git a/GanjooRazor/Areas/User/Pages/FAQItems.cshtml.cs b/GanjooRazor/Areas/User/Pages/FAQItems.cshtml.cs
index 907a6e4e..e4b73e40 100644
--- a/GanjooRazor/Areas/User/Pages/FAQItems.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/FAQItems.cshtml.cs
@@ -10,7 +10,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class FAQItemsModel : PageModel
     {
         public string LastMessage { get; set; }
diff --git a/GanjooRazor/Areas/User/Pages/FinalizeImages.cshtml b/GanjooRazor/Areas/User/Pages/FinalizeImages.cshtml
index d0763da1..36394a71 100644
--- a/GanjooRazor/Areas/User/Pages/FinalizeImages.cshtml
+++ b/GanjooRazor/Areas/User/Pages/FinalizeImages.cshtml
@@ -39,6 +39,7 @@ else
         </div>
 
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <input type="hidden" asp-for="ImageLinkFinalizeModel.Id" />
             <div class="up-field">
                 <label asp-for="ImageLinkFinalizeModel.DisplayOnPage"></label>
diff --git a/GanjooRazor/Areas/User/Pages/FinalizeImages.cshtml.cs b/GanjooRazor/Areas/User/Pages/FinalizeImages.cshtml.cs
index 4c385fc9..997bb531 100644
--- a/GanjooRazor/Areas/User/Pages/FinalizeImages.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/FinalizeImages.cshtml.cs
@@ -11,7 +11,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class FinalizeImagesModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/History.cshtml.cs b/GanjooRazor/Areas/User/Pages/History.cshtml.cs
index a8cf9ac0..f65cd89b 100644
--- a/GanjooRazor/Areas/User/Pages/History.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/History.cshtml.cs
@@ -18,7 +18,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class HistoryModel : PageModel
     {
 
diff --git a/GanjooRazor/Areas/User/Pages/Index.cshtml.cs b/GanjooRazor/Areas/User/Pages/Index.cshtml.cs
index 4b292f24..584378bf 100644
--- a/GanjooRazor/Areas/User/Pages/Index.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/Index.cshtml.cs
@@ -10,7 +10,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.Panel.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class IndexModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/LanguageEdit.cshtml b/GanjooRazor/Areas/User/Pages/LanguageEdit.cshtml
index 44ca2772..08cc75fc 100644
--- a/GanjooRazor/Areas/User/Pages/LanguageEdit.cshtml
+++ b/GanjooRazor/Areas/User/Pages/LanguageEdit.cshtml
@@ -16,6 +16,7 @@
 else
 {
     <form method="post">
+        @Html.AntiForgeryToken()
         <table>
             <tr>
                 <td>
diff --git a/GanjooRazor/Areas/User/Pages/LanguageEdit.cshtml.cs b/GanjooRazor/Areas/User/Pages/LanguageEdit.cshtml.cs
index 38c57402..7b445b3c 100644
--- a/GanjooRazor/Areas/User/Pages/LanguageEdit.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/LanguageEdit.cshtml.cs
@@ -10,7 +10,6 @@ using RMuseum.Models.Ganjoor;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class LanguageEditModel : PageModel
     {
         [BindProperty]
diff --git a/GanjooRazor/Areas/User/Pages/Languages.cshtml b/GanjooRazor/Areas/User/Pages/Languages.cshtml
index 74e7a971..7813b12b 100644
--- a/GanjooRazor/Areas/User/Pages/Languages.cshtml
+++ b/GanjooRazor/Areas/User/Pages/Languages.cshtml
@@ -19,6 +19,7 @@ else
     <div class="up-card">
         <h2 class="up-card__title">زبان جدید</h2>
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <div class="up-field">
                 <label for="Language_Name">نام</label>
                 <input asp-for="Language.Name" />
diff --git a/GanjooRazor/Areas/User/Pages/Languages.cshtml.cs b/GanjooRazor/Areas/User/Pages/Languages.cshtml.cs
index 606412ca..7bcba2b0 100644
--- a/GanjooRazor/Areas/User/Pages/Languages.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/Languages.cshtml.cs
@@ -10,7 +10,6 @@ using RMuseum.Models.Ganjoor;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class LanguagesModel : PageModel
     {
         public string LastMessage { get; set; }
diff --git a/GanjooRazor/Areas/User/Pages/MyBookmarks.cshtml b/GanjooRazor/Areas/User/Pages/MyBookmarks.cshtml
index 44ee4580..d2fef148 100644
--- a/GanjooRazor/Areas/User/Pages/MyBookmarks.cshtml
+++ b/GanjooRazor/Areas/User/Pages/MyBookmarks.cshtml
@@ -129,6 +129,7 @@ else
         <span onclick="document.getElementById('bookmark-note-dialog').style.display='none'"
           class="close" title="بستن">&times;</span>
         <form class="modal-content animate" method="post" id="editnoteform">
+            @Html.AntiForgeryToken()
             <table class="max-width-100per width-100per">
                 <tr>
                     <td>
diff --git a/GanjooRazor/Areas/User/Pages/MyBookmarks.cshtml.cs b/GanjooRazor/Areas/User/Pages/MyBookmarks.cshtml.cs
index f411e968..e554fa56 100644
--- a/GanjooRazor/Areas/User/Pages/MyBookmarks.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/MyBookmarks.cshtml.cs
@@ -17,7 +17,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class MyBookmarksModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/MyComments.cshtml b/GanjooRazor/Areas/User/Pages/MyComments.cshtml
index e51cbb1d..75a4c002 100644
--- a/GanjooRazor/Areas/User/Pages/MyComments.cshtml
+++ b/GanjooRazor/Areas/User/Pages/MyComments.cshtml
@@ -101,6 +101,7 @@ else
         <span onclick="document.getElementById('id02').style.display='none'"
           class="close" title="بستن">&times;</span>
         <form class="modal-content animate" method="post" id="editcommentform" action="?handler=EditComment">
+            @Html.AntiForgeryToken()
             <table style="max-width:100%; width:100%; margin:0">
                 <tr>
                     <td>
diff --git a/GanjooRazor/Areas/User/Pages/MyComments.cshtml.cs b/GanjooRazor/Areas/User/Pages/MyComments.cshtml.cs
index ad9cd134..5bf0ac6f 100644
--- a/GanjooRazor/Areas/User/Pages/MyComments.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/MyComments.cshtml.cs
@@ -17,7 +17,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class MyCommentsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/MySessions.cshtml.cs b/GanjooRazor/Areas/User/Pages/MySessions.cshtml.cs
index 736a68bf..22737a9e 100644
--- a/GanjooRazor/Areas/User/Pages/MySessions.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/MySessions.cshtml.cs
@@ -20,7 +20,6 @@ namespace GanjooRazor.Areas.User.Pages
     /// this list and kill a session they don't recognize (a lost/stolen device, a shared computer
     /// they forgot to log out of, ...) whenever they suspect something.
     /// </summary>
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class MySessionsModel : GanjoorPageModelBase
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/Notifications.cshtml.cs b/GanjooRazor/Areas/User/Pages/Notifications.cshtml.cs
index 9fa0c1f6..e121777f 100644
--- a/GanjooRazor/Areas/User/Pages/Notifications.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/Notifications.cshtml.cs
@@ -16,7 +16,6 @@ using RSecurityBackend.Models.Notification.ViewModels;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class NotificationsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/PoemCorrectionsHistory.cshtml.cs b/GanjooRazor/Areas/User/Pages/PoemCorrectionsHistory.cshtml.cs
index 8f9aa482..87a743b4 100644
--- a/GanjooRazor/Areas/User/Pages/PoemCorrectionsHistory.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/PoemCorrectionsHistory.cshtml.cs
@@ -16,7 +16,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class PoemCorrectionsHistoryModel : PageModel
     {
 
diff --git a/GanjooRazor/Areas/User/Pages/ReportedComments.cshtml.cs b/GanjooRazor/Areas/User/Pages/ReportedComments.cshtml.cs
index 12c93961..1ce93056 100644
--- a/GanjooRazor/Areas/User/Pages/ReportedComments.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/ReportedComments.cshtml.cs
@@ -16,7 +16,6 @@ using System.Text;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ReportedCommentsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/ReviewSongs.cshtml b/GanjooRazor/Areas/User/Pages/ReviewSongs.cshtml
index e39bce7f..708e5f93 100644
--- a/GanjooRazor/Areas/User/Pages/ReviewSongs.cshtml
+++ b/GanjooRazor/Areas/User/Pages/ReviewSongs.cshtml
@@ -27,6 +27,7 @@ else
 {
     <div class="up-card">
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <div class="up-field">
                 <label>شعر</label>
                 <div>
diff --git a/GanjooRazor/Areas/User/Pages/ReviewSongs.cshtml.cs b/GanjooRazor/Areas/User/Pages/ReviewSongs.cshtml.cs
index 865dfa23..7290c55b 100644
--- a/GanjooRazor/Areas/User/Pages/ReviewSongs.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/ReviewSongs.cshtml.cs
@@ -12,7 +12,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ReviewSongsModel : PageModel
     {
 
diff --git a/GanjooRazor/Areas/User/Pages/Section.cshtml.cs b/GanjooRazor/Areas/User/Pages/Section.cshtml.cs
index 01e29c27..b8423f02 100644
--- a/GanjooRazor/Areas/User/Pages/Section.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/Section.cshtml.cs
@@ -14,7 +14,6 @@ using RMuseum.Models.Ganjoor.ViewModels;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class SectionModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/SectionEdits.cshtml.cs b/GanjooRazor/Areas/User/Pages/SectionEdits.cshtml.cs
index da2cd93e..41db89c9 100644
--- a/GanjooRazor/Areas/User/Pages/SectionEdits.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/SectionEdits.cshtml.cs
@@ -15,7 +15,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class SectionEditsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/SuggestQuoted.cshtml b/GanjooRazor/Areas/User/Pages/SuggestQuoted.cshtml
index 9b365271..e81beb80 100644
--- a/GanjooRazor/Areas/User/Pages/SuggestQuoted.cshtml
+++ b/GanjooRazor/Areas/User/Pages/SuggestQuoted.cshtml
@@ -144,6 +144,7 @@
     </div>
     <div class="up-card">
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <div class="up-alert up-alert--info">
                 <p class="up-mt-0">از فهرست زیر بیتی را که نقل قول در آن رخ داده مشخص کنید.</p>
             </div>
diff --git a/GanjooRazor/Areas/User/Pages/SuggestQuoted.cshtml.cs b/GanjooRazor/Areas/User/Pages/SuggestQuoted.cshtml.cs
index 8ef1393a..72642510 100644
--- a/GanjooRazor/Areas/User/Pages/SuggestQuoted.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/SuggestQuoted.cshtml.cs
@@ -15,7 +15,6 @@ using System.Net;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class SuggestQuotedModel : PageModel
     {
         public string LastMessage { get; set; }
diff --git a/GanjooRazor/Areas/User/Pages/SuggestedPoetPhotos.cshtml b/GanjooRazor/Areas/User/Pages/SuggestedPoetPhotos.cshtml
index ceaeb42c..4b6bc245 100644
--- a/GanjooRazor/Areas/User/Pages/SuggestedPoetPhotos.cshtml
+++ b/GanjooRazor/Areas/User/Pages/SuggestedPoetPhotos.cshtml
@@ -17,6 +17,7 @@ else
 {
     <div class="up-card">
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <div class="up-field">
                 <label>سخنور</label>
                 <div>
diff --git a/GanjooRazor/Areas/User/Pages/SuggestedPoetPhotos.cshtml.cs b/GanjooRazor/Areas/User/Pages/SuggestedPoetPhotos.cshtml.cs
index deee829d..63673cac 100644
--- a/GanjooRazor/Areas/User/Pages/SuggestedPoetPhotos.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/SuggestedPoetPhotos.cshtml.cs
@@ -11,7 +11,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class SuggestedPoetPhotosModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/SuggestedPoetSpecLines.cshtml b/GanjooRazor/Areas/User/Pages/SuggestedPoetSpecLines.cshtml
index ce5ba0fa..b14443e1 100644
--- a/GanjooRazor/Areas/User/Pages/SuggestedPoetSpecLines.cshtml
+++ b/GanjooRazor/Areas/User/Pages/SuggestedPoetSpecLines.cshtml
@@ -17,6 +17,7 @@ else
 {
     <div class="up-card">
         <form method="post" class="up-form">
+            @Html.AntiForgeryToken()
             <div class="up-field">
                 <label>سخنور</label>
                 <div>
diff --git a/GanjooRazor/Areas/User/Pages/SuggestedPoetSpecLines.cshtml.cs b/GanjooRazor/Areas/User/Pages/SuggestedPoetSpecLines.cshtml.cs
index 7885fc34..7645c054 100644
--- a/GanjooRazor/Areas/User/Pages/SuggestedPoetSpecLines.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/SuggestedPoetSpecLines.cshtml.cs
@@ -11,7 +11,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class SuggestedPoetSpecLinesModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/UpVotedRecitations.cshtml.cs b/GanjooRazor/Areas/User/Pages/UpVotedRecitations.cshtml.cs
index 0614fb87..5c12c897 100644
--- a/GanjooRazor/Areas/User/Pages/UpVotedRecitations.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/UpVotedRecitations.cshtml.cs
@@ -15,7 +15,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class UpVotedRecitationsModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Areas/User/Pages/VerseAdd.cshtml b/GanjooRazor/Areas/User/Pages/VerseAdd.cshtml
index d5ddcad7..9c8bfa5a 100644
--- a/GanjooRazor/Areas/User/Pages/VerseAdd.cshtml
+++ b/GanjooRazor/Areas/User/Pages/VerseAdd.cshtml
@@ -48,6 +48,7 @@
 
                 <div class="up-card">
                     <form method="post" class="up-form">
+                        @Html.AntiForgeryToken()
                         <div class="up-field">
                             <label asp-for="NewVerses.VOrder">مصرع‌ها قبل از کدام مصرع می‌بایست درج شوند</label>
                             <select asp-for="NewVerses.VOrder">
diff --git a/GanjooRazor/Areas/User/Pages/VerseAdd.cshtml.cs b/GanjooRazor/Areas/User/Pages/VerseAdd.cshtml.cs
index c69b6138..76436931 100644
--- a/GanjooRazor/Areas/User/Pages/VerseAdd.cshtml.cs
+++ b/GanjooRazor/Areas/User/Pages/VerseAdd.cshtml.cs
@@ -16,7 +16,6 @@ using System.Linq;
 
 namespace GanjooRazor.Areas.User.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class VerseAddPageModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Pages/Auth/Login.cshtml b/GanjooRazor/Pages/Auth/Login.cshtml
index 16896eb3..2cd212a9 100644
--- a/GanjooRazor/Pages/Auth/Login.cshtml
+++ b/GanjooRazor/Pages/Auth/Login.cshtml
@@ -24,6 +24,7 @@
             @if (Model.LoggedIn)
             {
                 <form method="post" action="?handler=Logout">
+                    @Html.AntiForgeryToken()
                     <table>
                         <tr>
                             <td>
@@ -45,6 +46,7 @@
             else
             {
                 <form method="post" action="@("?handler=Login&redirect=" + Model.RedirectUrlEncoded)">
+                    @Html.AntiForgeryToken()
                     <table>
                         <tr>
                             <td>
diff --git a/GanjooRazor/Pages/Auth/Login.cshtml.cs b/GanjooRazor/Pages/Auth/Login.cshtml.cs
index a5034d3b..5d7d1173 100644
--- a/GanjooRazor/Pages/Auth/Login.cshtml.cs
+++ b/GanjooRazor/Pages/Auth/Login.cshtml.cs
@@ -5,7 +5,6 @@ using System.Net.Http;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class LoginModel : LoginPartialEnabledPageModel
     {
 
diff --git a/GanjooRazor/Pages/Auth/ResetPassword.cshtml b/GanjooRazor/Pages/Auth/ResetPassword.cshtml
index 9c615288..7e3e9c83 100644
--- a/GanjooRazor/Pages/Auth/ResetPassword.cshtml
+++ b/GanjooRazor/Pages/Auth/ResetPassword.cshtml
@@ -29,6 +29,7 @@
             if (Model.PhaseSendEmail)
             {
                 <form method="post" action="/resetpassword?Handler=SendEmail">
+                    @Html.AntiForgeryToken()
 
                     <table class="font-size-1em">
 
@@ -97,6 +98,7 @@
             if (Model.PhaseVerify)
             {
                 <form method="post" action="/resetpassword?Handler=Verify">
+                    @Html.AntiForgeryToken()
 
                     <table class="font-size-1em">
 
@@ -134,6 +136,7 @@
             else
             {
                 <form method="post" action="/resetpassword?Handler=Phase3">
+                    @Html.AntiForgeryToken()
 
                     <table class="font-size-1em">
 
diff --git a/GanjooRazor/Pages/Auth/ResetPassword.cshtml.cs b/GanjooRazor/Pages/Auth/ResetPassword.cshtml.cs
index 0d6d6583..5f3f2d67 100644
--- a/GanjooRazor/Pages/Auth/ResetPassword.cshtml.cs
+++ b/GanjooRazor/Pages/Auth/ResetPassword.cshtml.cs
@@ -17,7 +17,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ResetPasswordModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Pages/Auth/SignUp.cshtml b/GanjooRazor/Pages/Auth/SignUp.cshtml
index 812ae186..4c645709 100644
--- a/GanjooRazor/Pages/Auth/SignUp.cshtml
+++ b/GanjooRazor/Pages/Auth/SignUp.cshtml
@@ -30,6 +30,7 @@
             if (Model.SignupPhase1)
             {
                 <form method="post" action="/signup?Handler=Phase1">
+                    @Html.AntiForgeryToken()
                     <table class="font-size-1em">
 
                         <tr class="nobackground">
@@ -110,6 +111,7 @@
             if (Model.SignupVerifyEmailPhase)
             {
                 <form method="post" action="/signup?Handler=Phase2">
+                    @Html.AntiForgeryToken()
                     <table class="font-size-1em">
 
                         <tr class="nobackground">
@@ -144,6 +146,7 @@
             else
             {
                 <form method="post" action="/signup?Handler=Phase3">
+                    @Html.AntiForgeryToken()
                     <table class="font-size-1em">
 
                         <tr class="nobackground">
diff --git a/GanjooRazor/Pages/Auth/SignUp.cshtml.cs b/GanjooRazor/Pages/Auth/SignUp.cshtml.cs
index 8d5cfc7e..a2a4a420 100644
--- a/GanjooRazor/Pages/Auth/SignUp.cshtml.cs
+++ b/GanjooRazor/Pages/Auth/SignUp.cshtml.cs
@@ -16,7 +16,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class SignUpModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Pages/CommentReports/ReportComment.cshtml b/GanjooRazor/Pages/CommentReports/ReportComment.cshtml
index a02dc6ac..20abc3ed 100644
--- a/GanjooRazor/Pages/CommentReports/ReportComment.cshtml
+++ b/GanjooRazor/Pages/CommentReports/ReportComment.cshtml
@@ -83,6 +83,7 @@
                 <div class="content">
 
                     <form method="post">
+                        @Html.AntiForgeryToken()
                         <span class="inputlabel">چرا باید این حاشیه حذف شود؟</span><br>
                         <input type="radio" asp-for="Report.ReasonCode" value="offensive">توهین‌آمیز است.<br>
                         <input type="radio" asp-for="Report.ReasonCode" value="religious ">بحث مذهبی کرده.<br>
diff --git a/GanjooRazor/Pages/CommentReports/ReportComment.cshtml.cs b/GanjooRazor/Pages/CommentReports/ReportComment.cshtml.cs
index 603802ab..f342e6a4 100644
--- a/GanjooRazor/Pages/CommentReports/ReportComment.cshtml.cs
+++ b/GanjooRazor/Pages/CommentReports/ReportComment.cshtml.cs
@@ -9,7 +9,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ReportCommentModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Pages/Contribs.cshtml.cs b/GanjooRazor/Pages/Contribs.cshtml.cs
index eeff46e4..3a5e30d3 100644
--- a/GanjooRazor/Pages/Contribs.cshtml.cs
+++ b/GanjooRazor/Pages/Contribs.cshtml.cs
@@ -14,7 +14,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     [OutputCache(PolicyName = "GanjoorPublicPage")]
     public class ContribsModel : LoginPartialEnabledPageModel
     {
diff --git a/GanjooRazor/Pages/Error.cshtml.cs b/GanjooRazor/Pages/Error.cshtml.cs
index c0b71e80..c3dbc011 100644
--- a/GanjooRazor/Pages/Error.cshtml.cs
+++ b/GanjooRazor/Pages/Error.cshtml.cs
@@ -7,7 +7,6 @@ using System.Diagnostics;
 namespace GanjooRazor.Pages
 {
     [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
-    [IgnoreAntiforgeryToken]
     public class ErrorModel : PageModel
     {
         public string RequestId { get; set; }
diff --git a/GanjooRazor/Pages/FAQ.cshtml.cs b/GanjooRazor/Pages/FAQ.cshtml.cs
index 643d0702..390dba26 100644
--- a/GanjooRazor/Pages/FAQ.cshtml.cs
+++ b/GanjooRazor/Pages/FAQ.cshtml.cs
@@ -12,7 +12,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     [OutputCache(PolicyName = "GanjoorPublicPage")]
     public class FAQModel : LoginPartialEnabledPageModel
     {
diff --git a/GanjooRazor/Pages/GanjoorPage.cshtml.cs b/GanjooRazor/Pages/GanjoorPage.cshtml.cs
index 8802af7c..12a9f722 100644
--- a/GanjooRazor/Pages/GanjoorPage.cshtml.cs
+++ b/GanjooRazor/Pages/GanjoorPage.cshtml.cs
@@ -30,7 +30,6 @@ namespace GanjooRazor.Pages
     /// Startup.cs's AddPageRoute("/GanjoorPage", "{*url}") which now owns the site's catch-all route
     /// (Index.cshtml keeps its own automatic "/" route unchanged, so home is unaffected).
     /// </summary>
-    [IgnoreAntiforgeryToken(Order = 1001)]
     [OutputCache(PolicyName = "GanjoorPublicPage")]
     public partial class GanjoorPageModel : LoginPartialEnabledPageModel
     {
diff --git a/GanjooRazor/Pages/Hashieha.cshtml.cs b/GanjooRazor/Pages/Hashieha.cshtml.cs
index 22f7ceec..b155930b 100644
--- a/GanjooRazor/Pages/Hashieha.cshtml.cs
+++ b/GanjooRazor/Pages/Hashieha.cshtml.cs
@@ -19,7 +19,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     [OutputCache(PolicyName = "GanjoorPublicPage")]
     public class HashiehaModel : LoginPartialEnabledPageModel
     {
diff --git a/GanjooRazor/Pages/ImageRecommendation/Pin.cshtml b/GanjooRazor/Pages/ImageRecommendation/Pin.cshtml
index b91dc4e6..28d6a605 100644
--- a/GanjooRazor/Pages/ImageRecommendation/Pin.cshtml
+++ b/GanjooRazor/Pages/ImageRecommendation/Pin.cshtml
@@ -74,6 +74,7 @@
                </p>
 
                 <form method="post" action="/pin/?final=1">
+                    @Html.AntiForgeryToken()
                     <input type="hidden" asp-for="RelatedImageSuggestionModel.GanjoorTitle">
                     <input type="hidden" asp-for="RelatedImageSuggestionModel.PoemId">
                     <input type="hidden" asp-for="RelatedImageSuggestionModel.GanjoorUrl">
diff --git a/GanjooRazor/Pages/ImageRecommendation/Pin.cshtml.cs b/GanjooRazor/Pages/ImageRecommendation/Pin.cshtml.cs
index b60c23f5..cd446efb 100644
--- a/GanjooRazor/Pages/ImageRecommendation/Pin.cshtml.cs
+++ b/GanjooRazor/Pages/ImageRecommendation/Pin.cshtml.cs
@@ -11,7 +11,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class PinModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Pages/Index.cshtml.cs b/GanjooRazor/Pages/Index.cshtml.cs
index 46ca608d..60cf14f2 100644
--- a/GanjooRazor/Pages/Index.cshtml.cs
+++ b/GanjooRazor/Pages/Index.cshtml.cs
@@ -18,7 +18,6 @@ namespace GanjooRazor.Pages
     /// owns the site's catch-all route (see Startup.cs). This page keeps its own automatic "/" route,
     /// unaffected by that change.
     /// </summary>
-    [IgnoreAntiforgeryToken(Order = 1001)]
     [OutputCache(PolicyName = "GanjoorPublicPage")]
     public class IndexModel : LoginPartialEnabledPageModel
     {
diff --git a/GanjooRazor/Pages/Misc/Photos.cshtml b/GanjooRazor/Pages/Misc/Photos.cshtml
index 28cfd3e3..0ca00bc2 100644
--- a/GanjooRazor/Pages/Misc/Photos.cshtml
+++ b/GanjooRazor/Pages/Misc/Photos.cshtml
@@ -1,5 +1,6 @@
 @page
 @model GanjooRazor.Pages.PhotosModel
+@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Antiforgery
 @{
     Layout = null;
 }
@@ -8,6 +9,7 @@
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="csrf-token" content="@Antiforgery.GetAndStoreTokens(HttpContext).RequestToken" />
     <title>
         @Html.Raw(ViewData["Title"])
     </title>
@@ -229,6 +231,7 @@
                                 @if (Model.LoggedIn)
                                 {
                                     <form method="post" id="commentform" action="?handler=Suggest">
+                                        @Html.AntiForgeryToken()
                                         <fieldset>
                                             <legend>💬 شما نکتهٔ تازه‌ای پیشنهاد کنید ...</legend>
                                             <table class="comment-table">
@@ -384,6 +387,7 @@
                                     @if (string.IsNullOrEmpty(Model.LastError) && Model.UploadedPhoto == null)
                                     {
                                         <form method="post" enctype="multipart/form-data">
+                                            @Html.AntiForgeryToken()
                                             <fieldset>
                                                 <legend>💬 شما تصویر تازه‌ای پیشنهاد کنید ...</legend>
                                                 <table class="comment-table">
diff --git a/GanjooRazor/Pages/Misc/Photos.cshtml.cs b/GanjooRazor/Pages/Misc/Photos.cshtml.cs
index 88149deb..8603f4bd 100644
--- a/GanjooRazor/Pages/Misc/Photos.cshtml.cs
+++ b/GanjooRazor/Pages/Misc/Photos.cshtml.cs
@@ -14,7 +14,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class PhotosModel : LoginPartialEnabledPageModel
     {
         public string LastError { get; set; }
diff --git a/GanjooRazor/Pages/Partials/GanjoorPage/PageTypes/_PoemPagePartial.cshtml b/GanjooRazor/Pages/Partials/GanjoorPage/PageTypes/_PoemPagePartial.cshtml
index 1ca259d1..70f16624 100644
--- a/GanjooRazor/Pages/Partials/GanjoorPage/PageTypes/_PoemPagePartial.cshtml
+++ b/GanjooRazor/Pages/Partials/GanjoorPage/PageTypes/_PoemPagePartial.cshtml
@@ -115,6 +115,7 @@
             {
                 <div class="width-100per display-block">
                     <form method="post" action="/pin">
+                        @Html.AntiForgeryToken()
                         <input type="hidden" id="RelatedImageSuggestionModel_PoemId" name="RelatedImageSuggestionModel.PoemId" value="@Model.GanjoorPage.Id">
                         <input type="hidden" id="RelatedImageSuggestionModel_GanjoorUrl" name="RelatedImageSuggestionModel.GanjoorUrl" value="@Model.GanjoorPage.FullUrl">
                         <input type="hidden" id="RelatedImageSuggestionModel_GanjoorTitle" name="RelatedImageSuggestionModel.GanjoorTitle" value="@Model.GanjoorPage.FullTitle">
diff --git a/GanjooRazor/Pages/Quotes.cshtml.cs b/GanjooRazor/Pages/Quotes.cshtml.cs
index 3b7a745b..3c6d141c 100644
--- a/GanjooRazor/Pages/Quotes.cshtml.cs
+++ b/GanjooRazor/Pages/Quotes.cshtml.cs
@@ -10,7 +10,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     [OutputCache(PolicyName = "GanjoorPublicPage")]
     public class QuotesModel : LoginPartialEnabledPageModel
     {
diff --git a/GanjooRazor/Pages/Recitations/ReportRecitation.cshtml b/GanjooRazor/Pages/Recitations/ReportRecitation.cshtml
index 9b7d252e..878bf8a3 100644
--- a/GanjooRazor/Pages/Recitations/ReportRecitation.cshtml
+++ b/GanjooRazor/Pages/Recitations/ReportRecitation.cshtml
@@ -1,6 +1,7 @@
 @page
 @model GanjooRazor.Pages.ReportRecitationModel
 @using DNTPersianUtils.Core
+@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Antiforgery
 @{
     Layout = null;
 }
@@ -11,6 +12,7 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="robots" content="noindex, nofollow" />
+    <meta name="csrf-token" content="@Antiforgery.GetAndStoreTokens(HttpContext).RequestToken" />
     <title>گنجور » گزارش خطا در خوانش</title>
     <script src="/lib/jquery/dist/jquery.min.js"></script>
     <link href="~/css/p8.css" asp-append-version="true" rel="stylesheet" type="text/css" />
@@ -89,6 +91,7 @@
 
                 <div class="content">
                     <form method="post">
+                        @Html.AntiForgeryToken()
                         <table class="width-100per">
                             <tr>
                                 <td>
diff --git a/GanjooRazor/Pages/Recitations/ReportRecitation.cshtml.cs b/GanjooRazor/Pages/Recitations/ReportRecitation.cshtml.cs
index 11808603..594c632d 100644
--- a/GanjooRazor/Pages/Recitations/ReportRecitation.cshtml.cs
+++ b/GanjooRazor/Pages/Recitations/ReportRecitation.cshtml.cs
@@ -15,7 +15,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class ReportRecitationModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Pages/Search.cshtml.cs b/GanjooRazor/Pages/Search.cshtml.cs
index 895b8b33..89af6ae5 100644
--- a/GanjooRazor/Pages/Search.cshtml.cs
+++ b/GanjooRazor/Pages/Search.cshtml.cs
@@ -18,7 +18,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     [OutputCache(PolicyName = "GanjoorPublicPage")]
     public class SearchModel : LoginPartialEnabledPageModel
     {
diff --git a/GanjooRazor/Pages/Shared/_AdminLayout.cshtml b/GanjooRazor/Pages/Shared/_AdminLayout.cshtml
index 95328763..c43dfed9 100644
--- a/GanjooRazor/Pages/Shared/_AdminLayout.cshtml
+++ b/GanjooRazor/Pages/Shared/_AdminLayout.cshtml
@@ -1,9 +1,11 @@
-<!DOCTYPE html>
+@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Antiforgery
+<!DOCTYPE html>
 <html lang="fa-IR" dir="rtl">
 <head>
     <meta charset="utf-8" />
     <meta name="robots" content="noindex, nofollow" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="csrf-token" content="@Antiforgery.GetAndStoreTokens(Context).RequestToken" />
     <title>
         @Html.Raw(ViewData["Title"])
     </title>
@@ -515,6 +517,7 @@
 
                         <li class="nav-item">
                             <form method="post" action="/login?handler=Logout">
+                                @Html.AntiForgeryToken()
                                 <button type="submit" class="nav-link text-dark" title="خروج از حساب کاربری">خروج</button>
                             </form>
                         </li>
diff --git a/GanjooRazor/Pages/Shared/_InlineLoginPartial.cshtml b/GanjooRazor/Pages/Shared/_InlineLoginPartial.cshtml
index 20d96eb7..884cd4fd 100644
--- a/GanjooRazor/Pages/Shared/_InlineLoginPartial.cshtml
+++ b/GanjooRazor/Pages/Shared/_InlineLoginPartial.cshtml
@@ -123,6 +123,7 @@ else
 
         <!-- Modal Content -->
         <form class="modal-content animate" method="post" action="?handler=Login">
+            @Html.AntiForgeryToken()
             <div class="imgcontainer">
                 <img src="/image/login.png" alt="گنجور" class="avatar">
             </div>
diff --git a/GanjooRazor/Pages/Shared/_Layout.cshtml b/GanjooRazor/Pages/Shared/_Layout.cshtml
index 041fc037..4f4fefac 100644
--- a/GanjooRazor/Pages/Shared/_Layout.cshtml
+++ b/GanjooRazor/Pages/Shared/_Layout.cshtml
@@ -1,4 +1,5 @@
-@{
+@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Antiforgery
+@{
     // Shared layout for public-site pages (Pages/ folder). NOT used by Areas/Admin or Areas/User,
     // which have their own separate _AdminLayout / _UserPanelLayout under their own Areas/*/Pages/Shared
     // folders - see Areas/Admin/Pages/_ViewStart.cshtml and Areas/User/Pages/_ViewStart.cshtml.
@@ -29,6 +30,7 @@
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="csrf-token" content="@Antiforgery.GetAndStoreTokens(Context).RequestToken" />
     <title>@Html.Raw(ViewData["Title"])</title>
     <link href="~/css/p8.css" asp-append-version="true" rel="stylesheet" type="text/css" />
     <link rel="shortcut icon" href="/favicon.ico?version=1" type="image/x-icon" />
diff --git a/GanjooRazor/Pages/Shared/_UserPanelLayout.cshtml b/GanjooRazor/Pages/Shared/_UserPanelLayout.cshtml
index 35eeb1aa..31b48064 100644
--- a/GanjooRazor/Pages/Shared/_UserPanelLayout.cshtml
+++ b/GanjooRazor/Pages/Shared/_UserPanelLayout.cshtml
@@ -1,9 +1,11 @@
-<!DOCTYPE html>
+@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Antiforgery
+<!DOCTYPE html>
 <html lang="fa-IR" dir="rtl">
 <head>
     <meta charset="utf-8" />
     <meta name="robots" content="noindex, nofollow" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="csrf-token" content="@Antiforgery.GetAndStoreTokens(Context).RequestToken" />
     <title>
         @Html.Raw(ViewData["Title"])
     </title>
@@ -180,6 +182,7 @@
 
                         <li class="nav-item">
                             <form method="post" action="/login?handler=Logout">
+                                @Html.AntiForgeryToken()
                                 <button type="submit" class="nav-link text-dark" title="خروج از حساب کاربری">خروج</button>
                             </form>
                         </li>
diff --git a/GanjooRazor/Pages/Simi.cshtml.cs b/GanjooRazor/Pages/Simi.cshtml.cs
index 80384963..e9c56261 100644
--- a/GanjooRazor/Pages/Simi.cshtml.cs
+++ b/GanjooRazor/Pages/Simi.cshtml.cs
@@ -19,7 +19,6 @@ using RSecurityBackend.Models.Generic;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     [OutputCache(PolicyName = "GanjoorPublicPage")]
     public class SimiModel : LoginPartialEnabledPageModel
     {
diff --git a/GanjooRazor/Pages/SongRecommendation/Bp.cshtml b/GanjooRazor/Pages/SongRecommendation/Bp.cshtml
index 3004fb7d..a9ff3c4a 100644
--- a/GanjooRazor/Pages/SongRecommendation/Bp.cshtml
+++ b/GanjooRazor/Pages/SongRecommendation/Bp.cshtml
@@ -161,6 +161,7 @@
                 <div id="resultq"></div>
 
                 <form method="post">
+                    @Html.AntiForgeryToken()
                     <input type="hidden" asp-for="PoemMusicTrackViewModel.ArtistName" />
                     <input type="hidden" asp-for="PoemMusicTrackViewModel.ArtistUrl" />
                     <input type="hidden" asp-for="PoemMusicTrackViewModel.AlbumName" />
diff --git a/GanjooRazor/Pages/SongRecommendation/Bp.cshtml.cs b/GanjooRazor/Pages/SongRecommendation/Bp.cshtml.cs
index 19d6d45d..bb7aabf6 100644
--- a/GanjooRazor/Pages/SongRecommendation/Bp.cshtml.cs
+++ b/GanjooRazor/Pages/SongRecommendation/Bp.cshtml.cs
@@ -18,7 +18,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class BpModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Pages/SongRecommendation/Golha.cshtml b/GanjooRazor/Pages/SongRecommendation/Golha.cshtml
index 92242415..044b3d2b 100644
--- a/GanjooRazor/Pages/SongRecommendation/Golha.cshtml
+++ b/GanjooRazor/Pages/SongRecommendation/Golha.cshtml
@@ -153,6 +153,7 @@
                 <span class="inputlabel">شمارهٔ برنامه: </span><select name="program" id="program" disabled="disabled" class="albumtrack"></select>&nbsp;<span style="visibility:hidden" id="l2"><a id="programlink" href="#" target="_blank">صفحهٔ برنامه</a></span><br />
                 <span class="inputlabel">قطعه: </span><select name="track" id="track" disabled="disabled" class="albumtrack"></select>&nbsp;<span style="visibility:hidden" id="l3"></span><br />
                 <form method="post">
+                    @Html.AntiForgeryToken()
                     <input type="hidden" asp-for="PoemMusicTrackViewModel.GolhaTrackId" />
                     <span class="inputlabel">توضیح: </span><input type="text" class="albumtrack" placeholder="توضیح" asp-for="PoemMusicTrackViewModel.Description" />
                     <br />
diff --git a/GanjooRazor/Pages/SongRecommendation/Golha.cshtml.cs b/GanjooRazor/Pages/SongRecommendation/Golha.cshtml.cs
index 98ca5abb..a178a76d 100644
--- a/GanjooRazor/Pages/SongRecommendation/Golha.cshtml.cs
+++ b/GanjooRazor/Pages/SongRecommendation/Golha.cshtml.cs
@@ -12,7 +12,6 @@ using RMuseum.Models.MusicCatalogue.ViewModels;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class GolhaModel : PageModel
     {
 
diff --git a/GanjooRazor/Pages/SongRecommendation/Spotify.cshtml b/GanjooRazor/Pages/SongRecommendation/Spotify.cshtml
index 745886fc..776b62e5 100644
--- a/GanjooRazor/Pages/SongRecommendation/Spotify.cshtml
+++ b/GanjooRazor/Pages/SongRecommendation/Spotify.cshtml
@@ -164,6 +164,7 @@
                             <div id="resultq"></div>
                             <div id="searching-songs" style="display:none"><img src="/image/loading.gif" /></div>
                             <form method="post">
+                                @Html.AntiForgeryToken()
                                 <input type="hidden" asp-for="PoemMusicTrackViewModel.ArtistName" />
                                 <input type="hidden" asp-for="PoemMusicTrackViewModel.ArtistUrl" />
                                 <input type="hidden" asp-for="PoemMusicTrackViewModel.AlbumName" />
diff --git a/GanjooRazor/Pages/SongRecommendation/Spotify.cshtml.cs b/GanjooRazor/Pages/SongRecommendation/Spotify.cshtml.cs
index a7d42fe8..df4b95a4 100644
--- a/GanjooRazor/Pages/SongRecommendation/Spotify.cshtml.cs
+++ b/GanjooRazor/Pages/SongRecommendation/Spotify.cshtml.cs
@@ -19,7 +19,6 @@ using System.Threading.Tasks;
 
 namespace GanjooRazor.Pages
 {
-    [IgnoreAntiforgeryToken(Order = 1001)]
     public class SpotifyModel : PageModel
     {
         /// <summary>
diff --git a/GanjooRazor/Startup.cs b/GanjooRazor/Startup.cs
index 5796ad48..cc08b39e 100644
--- a/GanjooRazor/Startup.cs
+++ b/GanjooRazor/Startup.cs
@@ -100,6 +100,16 @@ namespace GanjooRazor
                 options.Conventions.AddPageRoute("/Misc/t6e", "/t6e");
             });
 
+            // The antiforgery token bk.js's $.ajax POST/PUT/DELETE calls carry, as a request
+            // header rather than a form field (there's no <form> around most of these calls).
+            // The token value itself is rendered into each page as a <meta name="csrf-token">
+            // tag (see _Layout.cshtml / _UserPanelLayout.cshtml / _AdminLayout.cshtml), and
+            // bk.js reads it once and attaches it to every AJAX request via $.ajaxSetup.
+            services.AddAntiforgery(options =>
+            {
+                options.HeaderName = "X-CSRF-TOKEN";
+            });
+
             services.AddCors(options =>
             {
                 options.AddPolicy(name: "GanjoorCorsPolicy",
diff --git a/GanjooRazor/wwwroot/js/bk.js b/GanjooRazor/wwwroot/js/bk.js
index b6dd09c9..09605c72 100644
--- a/GanjooRazor/wwwroot/js/bk.js
+++ b/GanjooRazor/wwwroot/js/bk.js
@@ -1,4 +1,24 @@
-// --- Sanitizer "text was dropped" feedback ----------------------------------------------
+// --- CSRF (antiforgery) token for AJAX calls --------------------------------------------
+// Every POST/PUT/DELETE handler in the app validates an antiforgery token by default. A real
+// <form> submission gets that token for free (the asp-* form tag helper / @Html.AntiForgeryToken()
+// injects a hidden field automatically), but the many $.ajax(...) calls in this file talk to
+// those same handlers directly with no <form> involved, so they need to attach the token
+// themselves. The token value is rendered once per page as <meta name="csrf-token" ...> (see
+// _Layout.cshtml / _UserPanelLayout.cshtml / _AdminLayout.cshtml and the couple of standalone
+// pages that make their own $.ajax calls), and this reads it once and attaches it to every
+// jQuery AJAX request as a header from here on - so individual $.ajax(...) calls below don't
+// need to be touched one by one. A page that doesn't render the meta tag (i.e. has nothing that
+// needs it) simply sends no header, which is harmless.
+(function () {
+    var token = $('meta[name="csrf-token"]').attr('content');
+    if (token) {
+        $.ajaxSetup({
+            headers: { 'X-CSRF-TOKEN': token }
+        });
+    }
+})();
+
+// --- Sanitizer "text was dropped" feedback ----------------------------------------------
 // Shared by every place a TinyMCE-edited field (a comment, a bookmark note, a suggested
 // poet spec-line, ...) gets rejected because the server's HTML sanitizer had to drop real
 // text (see GanjoorService._BuildSanitizerDroppedTextError on the API side). Instead of just