From 8f1c5c49fd72ba552e8347dedcf71e99796edd4c Mon Sep 17 00:00:00 2001
From: Thanakorn S <ts_nok@hotmail.com>
Date: Tue, 12 May 2026 17:02:13 +0700
Subject: [PATCH] fix onboarding

---
 app/login/onboarding.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/login/onboarding.php b/app/login/onboarding.php
index 5a329a3..f63c3d6 100644
--- a/app/login/onboarding.php
+++ b/app/login/onboarding.php
@@ -1,7 +1,6 @@
 <?php
     require '../session.php';
     require '../config.php';
-    require '../include_header.php';
 
     // Must come from email verification
     if (empty($_SESSION['onboarding_user_id'])) {
@@ -9,11 +8,13 @@
         exit;
     }
 
-    // Generate CSRF token if not already set
+    // Generate CSRF token before include_header.php outputs the meta tag
     if (empty($_SESSION['csrf_token'])) {
         $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
     }
 
+    require '../include_header.php';
+
     $user_name = htmlspecialchars($_SESSION['onboarding_name'] ?? 'there');
 ?>