diff --git a/make_post_sell/templates/crypto_checkout.j2 b/make_post_sell/templates/crypto_checkout.j2
index 4805dd0..fa5b7af 100644
--- a/make_post_sell/templates/crypto_checkout.j2
+++ b/make_post_sell/templates/crypto_checkout.j2
@@ -1,6 +1,7 @@
 {% extends "base.j2" -%}
 
 {% block content -%}
+{% include "snippets/csrf.j2" %}
 <section class="one-column">
   <h2>{{ coin_name }} ({{ coin_symbol }}) Checkout</h2>
 
@@ -239,7 +240,14 @@
             'X-CSRF-Token': document.querySelector('input[name="csrf_token"]') ? document.querySelector('input[name="csrf_token"]').value : ''
           }
         })
-        .then(response => response.json())
+        .then(response => {
+          console.log('Response status:', response.status);
+          console.log('Response headers:', response.headers);
+          if (!response.ok) {
+            throw new Error(`HTTP error! status: ${response.status}`);
+          }
+          return response.json();
+        })
         .then(data => {
           if (data.success) {
             alert('Payment quote cancelled successfully');
diff --git a/make_post_sell/views/crypto.py b/make_post_sell/views/crypto.py
index 6601c4d..4c28e32 100644
--- a/make_post_sell/views/crypto.py
+++ b/make_post_sell/views/crypto.py
@@ -694,7 +694,7 @@ def crypto_doge_status(request):
     )
 
 
-@view_config(route_name="crypto_cancel", request_method="POST")
+@view_config(route_name="crypto_cancel", request_method="POST", require_csrf=True)
 @user_required()
 def crypto_cancel(request):
     """Cancel a pending crypto payment."""