diff --git a/ref-test/admin/templates/admin/components/base.html b/ref-test/admin/templates/admin/components/base.html
index 1e7ca4c..c871c41 100644
--- a/ref-test/admin/templates/admin/components/base.html
+++ b/ref-test/admin/templates/admin/components/base.html
@@ -53,6 +53,17 @@
             crossorigin="anonymous"
         ></script>
         <!-- Custom js -->
+        <script type="text/javascript">
+            var csrf_token = "{{ csrf_token() }}";
+        
+            $.ajaxSetup({
+                beforeSend: function(xhr, settings) {
+                    if (!/^(GET|HEAD|OPTIONS|TRACE)$/i.test(settings.type) && !this.crossDomain) {
+                        xhr.setRequestHeader("X-CSRFToken", csrf_token);
+                    }
+                }
+            });
+        </script>
         <script
             type="text/javascript"
             src="{{ url_for('.static', filename='js/script.js') }}"
diff --git a/ref-test/quiz/templates/quiz/components/base.html b/ref-test/quiz/templates/quiz/components/base.html
index 7c01603..fd8f26f 100644
--- a/ref-test/quiz/templates/quiz/components/base.html
+++ b/ref-test/quiz/templates/quiz/components/base.html
@@ -51,6 +51,17 @@
             crossorigin="anonymous"
         ></script>
         <!-- Custom js -->
+        <script type="text/javascript">
+            var csrf_token = "{{ csrf_token() }}";
+        
+            $.ajaxSetup({
+                beforeSend: function(xhr, settings) {
+                    if (!/^(GET|HEAD|OPTIONS|TRACE)$/i.test(settings.type) && !this.crossDomain) {
+                        xhr.setRequestHeader("X-CSRFToken", csrf_token);
+                    }
+                }
+            });
+        </script>
         <script
             type="text/javascript"
             src="{{ url_for('.static', filename='js/script.js') }}"