diff --git a/views/article_edit.ejs b/views/article_edit.ejs
index d696d24..9dfddfd 100644
--- a/views/article_edit.ejs
+++ b/views/article_edit.ejs
@@ -39,7 +39,7 @@
 <script type="text/javascript">
 $(function () {
     function render(output, input) {
-      $.post('/api/markdown', { s: input.val() }, function (s) {
+      $.post('/api/markdown', { s: input.val(), _csrf: document.head.getAttribute('data-csrf-token') }, function (s) {
         // console.log(s);
         output.html(s);
       });
diff --git a/views/login.ejs b/views/login.ejs
index 2981e91..aef1ddd 100644
--- a/views/login.ejs
+++ b/views/login.ejs
@@ -58,7 +58,8 @@ function login() {
         type: 'POST',
         data: {
             "username": $("#username").val(),
-            "password": password
+            "password": password,
+            "_csrf": document.head.getAttribute('data-csrf-token')
         },
         async: true,
         success: function(data) {
diff --git a/views/problem_edit.ejs b/views/problem_edit.ejs
index 0a33d36..90608a1 100644
--- a/views/problem_edit.ejs
+++ b/views/problem_edit.ejs
@@ -71,7 +71,7 @@
 <script type="text/javascript">
 $(function () {
     function render(output, input) {
-      $.post('/api/markdown', { s: input.val() }, function (s) {
+      $.post('/api/markdown', { s: input.val(), _csrf: document.head.getAttribute('data-csrf-token') }, function (s) {
         // console.log(s);
         output.html(s);
       });
diff --git a/views/sign_up.ejs b/views/sign_up.ejs
index 3274cb0..8391e36 100644
--- a/views/sign_up.ejs
+++ b/views/sign_up.ejs
@@ -62,7 +62,8 @@ function submit() {
           username: $("#username").val(),
           password: password,
           email: $("#email").val(),
-          prevUrl: <%- JSON.stringify(req.query.url || '/') %>
+          prevUrl: <%- JSON.stringify(req.query.url || '/') %>,
+          _csrf: document.head.getAttribute('data-csrf-token')
         },
         success: function(data) {
             error_code = data.error_code;