diff --git a/js/comments.js b/js/comments.js
index b9b83b0..9ad43a8 100644
--- a/js/comments.js
+++ b/js/comments.js
@@ -109,6 +109,12 @@ document.addEventListener("DOMContentLoaded", function () {
         action="index.php?pfad=updateComment"
         class="edit-comment-form"
     >
+        <input
+            type="hidden"
+            name="csrf_token"
+            value="${escapeHtml(formData.get("csrf_token"))}"
+        >
+
         <input
             type="hidden"
             name="comment_id"
@@ -137,6 +143,12 @@ document.addEventListener("DOMContentLoaded", function () {
             action="index.php?pfad=deleteComment"
             class="delete-comment-form"
         >
+            <input
+                type="hidden"
+                name="csrf_token"
+                value="${escapeHtml(formData.get("csrf_token"))}"
+            >
+
             <input
                 type="hidden"
                 name="comment_id"
@@ -187,6 +199,12 @@ document.addEventListener("DOMContentLoaded", function () {
         action="index.php?pfad=updateComment"
         class="edit-comment-form"
     >
+        <input
+            type="hidden"
+            name="csrf_token"
+            value="${escapeHtml(formData.get("csrf_token"))}"
+        >
+
         <input
             type="hidden"
             name="comment_id"
@@ -215,6 +233,12 @@ document.addEventListener("DOMContentLoaded", function () {
             action="index.php?pfad=deleteComment"
             class="delete-comment-form"
         >
+            <input
+                type="hidden"
+                name="csrf_token"
+                value="${escapeHtml(formData.get("csrf_token"))}"
+            >
+
             <input
                 type="hidden"
                 name="comment_id"