diff --git a/pagure/__init__.py b/pagure/__init__.py
index 29f876e..0dc8ff3 100644
--- a/pagure/__init__.py
+++ b/pagure/__init__.py
@@ -32,6 +32,7 @@ from sqlalchemy.exc import SQLAlchemyError
 import pagure.lib
 import pagure.mail_logging
 import pagure.doc_utils
+import pagure.forms
 import pagure.login_forms
 
 from pygments import highlight
@@ -213,10 +214,15 @@ def inject_variables():
     """
     user_admin = is_admin()
 
+    forkbuttonform = None
+    if authenticated():
+        forkbuttonform = pagure.forms.ConfirmationForm()
+
     return dict(
         version=__version__,
         admin=user_admin,
         authenticated=authenticated(),
+        forkbuttonform=forkbuttonform,
     )
 
 
diff --git a/pagure/templates/repo_master.html b/pagure/templates/repo_master.html
index 4598512..1b484b7 100644
--- a/pagure/templates/repo_master.html
+++ b/pagure/templates/repo_master.html
@@ -82,9 +82,12 @@
     <ul class="right">
       {% if g.fas_user and g.fas_user.username != repo.user.user %}
       <li id="fork_button" {% if select == '' %}class="selected" {% endif %}>
-        <a href="{{ url_for(
+        <form method="POST" name="fork_project"
+          action="{{ url_for(
             'fork_project', repo=repo.name, username=username) }}">
-        Fork</a>
+          <a onclick="fork_project.submit();" id="fork_project">Fork</a>
+          {{ forkbuttonform.csrf_token }}
+        </form>
       </li>
       {% endif %}
       {% if g.fas_user and g.fas_user.username == repo.user.user %}