diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/list.tt
index 357b159eb5..7c07c8d87d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/list.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/list.tt
@@ -80,7 +80,15 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
                         </li>
                         [% END %]</ul>[% ELSE %]This record has no items.[% END %]
                     </td>
-                    <td><form method="post" action="/cgi-bin/koha/tags/list.pl"><input type="hidden" name="op" value="del" /><input type="hidden" name="tag" value="[% tag | html %]" /><input type="hidden" name="tag_id" value="[% title.tag_id | html %]" /><button type="submit" class="delete btn btn-default btn-sm"><i class="fa fa-trash-can"></i> Remove tag</button></form></td>
+                    <td>
+                        <form method="post" action="/cgi-bin/koha/tags/list.pl">
+                            [% INCLUDE 'csrf-token.inc' %]
+                            <input type="hidden" name="op" value="cud-del" />
+                            <input type="hidden" name="tag" value="[% tag | html %]" />
+                            <input type="hidden" name="tag_id" value="[% title.tag_id | html %]" />
+                            <button type="submit" class="delete btn btn-default btn-sm"><i class="fa fa-trash-can"></i> Remove tag</button>
+                        </form>
+                    </td>
                     </tr>
                 [% END %]
             </table>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/js/tags.js b/koha-tmpl/opac-tmpl/bootstrap/js/tags.js
index b7b7612c8e..6e2e81b1b1 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/js/tags.js
+++ b/koha-tmpl/opac-tmpl/bootstrap/js/tags.js
@@ -17,6 +17,8 @@ KOHA.Tags = {
         var mytagid = "#" + mynewtag;
         var mydata = {};
         mydata[mynewtag] = tag;
+        mydata['csrf_token'] = $('meta[name="csrf-token"]').attr('content')
+        mydata['op'] = 'cud-add';
         var response;	// AJAX from server will assign value to response.
         $.post(
             "/cgi-bin/koha/opac-tags.pl",
@@ -74,6 +76,8 @@ KOHA.Tags = {
             var mynewtag = "newtag" + bibarray[i];
             mydata[mynewtag] = tag;
         }
+        mydata['csrf_token'] = $('meta[name="csrf-token"]').attr('content')
+        mydata['op'] = 'cud-add';
         var response;	// AJAX from server will assign value to response.
         $.post(
             "/cgi-bin/koha/opac-tags.pl",