diff --git a/frontend/app.js b/frontend/app.js
index fe3c95e..4fb0b9e 100644
--- a/frontend/app.js
+++ b/frontend/app.js
@@ -1440,6 +1440,10 @@
       // Inject auth header if authenticated
       const authHeaders = AuthManager.getAuthHeaders();
       const mergedOpts = opts || {};
+      // Auto-set Content-Type for JSON bodies
+      if (mergedOpts.body && typeof mergedOpts.body === "string" && !mergedOpts.headers?.["Content-Type"]) {
+        mergedOpts.headers = { ...mergedOpts.headers, "Content-Type": "application/json" };
+      }
       if (authHeaders) {
         mergedOpts.headers = { ...mergedOpts.headers, ...authHeaders };
       }
@@ -3273,7 +3277,7 @@
     const bookmarkBtn = el("button", { class: "btn-action", title: "Ajouter/Retirer des bookmarks" }, [icon("bookmark-plus", 14), document.createTextNode("Bookmark")]);
     bookmarkBtn.addEventListener("click", async () => {
       try {
-        const res = await api("/api/bookmarks/toggle", { method: "POST", body: JSON.stringify({ vault: data.vault, path: data.path, title: data.title }) });
+        const res = await api("/api/bookmarks/toggle", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ vault: data.vault, path: data.path, title: data.title }) });
         showToast(res.bookmarked ? "Ajouté aux bookmarks" : "Retiré des bookmarks", "success");
         if (typeof DashboardBookmarkWidget !== "undefined") DashboardBookmarkWidget.load();
       } catch (err) { showToast("Erreur: " + err.message, "error"); }
@@ -4620,6 +4624,7 @@
             const expiry = document.getElementById("share-expiry")?.value;
             const share = await api(`/api/share/${encodeURIComponent(vault)}`, {
               method: "POST",
+              headers: { "Content-Type": "application/json" },
               body: JSON.stringify({ path, expires_in_hours: expiry ? parseInt(expiry) : null }),
             });
             existingShare = share;
@@ -5536,6 +5541,11 @@
   // ---------------------------------------------------------------------------
   // Helpers
   // ---------------------------------------------------------------------------
+  function escapeHtml(str) {
+    if (!str) return "";
+    return String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  }
+
   function el(tag, attrs, children) {
     const e = document.createElement(tag);
     if (attrs) {
@@ -6658,6 +6668,7 @@
       try {
         const data = await api("/api/bookmarks/toggle", {
           method: "POST",
+          headers: { "Content-Type": "application/json" },
           body: JSON.stringify({ vault: this._targetVault, path: this._targetPath, title: this._targetPath.split("/").pop() }),
         });
         showToast(data.bookmarked ? "Ajouté aux bookmarks" : "Retiré des bookmarks", "success");