[ISSUE]: CSRF Token Cookie Parsing Logic Bug in security.js #396

Description

Description:
In getCSRFToken() function in frontend/js/security.js, the cookie parsing logic has a subtle bug. The loop uses indexOf() incorrectly - it checks if the cookie string CONTAINS the search term anywhere but doesn't properly match cookie boundaries:

// In getCSRFToken (lines 159-167):
for (let i = 0; i < cookieArray.length; i++) {
    let cookie = cookieArray[i].trim()
    if (cookie.indexOf(name) === 0) {  // BUG: indexOf returns position, not boolean!
        return cookie.substring(name.length)
    }
}

The issue is that cookie.indexOf(name) === 0 is incorrect because:

1. It should use cookie.startsWith(name) or compare with === 0
2. More critically, the code should also check for = after the cookie name to properly parse cookie values

Steps to fix:

1. Open frontend/js/security.js
2. Find the getCSRFToken() function
3. Replace the cookie parsing loop with:

   for (let i = 0; i < cookieArray.length; i++) {
       let cookie = cookieArray[i].trim();
       // Properly check if this cookie starts with the name and has = separator
       if (cookie.startsWith(name) || cookie.indexOf(name + '=') === 0) {
           // Handle both "name=value" and "name = value" formats
           let prefix = name + '=';
           if (cookie.startsWith(prefix)) {
               return cookie.substring(prefix.length);
           }
           // Handle without = sign (edge case)
           return cookie.substring(name.length);
       }
   }

Additional Context

No response