⚠ FOR SECURITY TESTING PURPOSES ONLY — DO NOT DEPLOY IN PRODUCTION
CSRF
Cross-Site Request Forgery
State-changing forms with no CSRF token, no SameSite cookie, and no origin/referer validation. Any cross-origin POST is accepted.
> Show hints
- [1] POST /api/csrf/update-profile with email and role — no token needed
- [2] Forge a form on evil.com that auto-submits to this endpoint
- [3] No Set-Cookie SameSite attribute, no X-CSRF-Token header required
- [4] Click [SIMULATE ATTACK] to see a forged request succeed
[CURRENT STATE] Logged-in User
{
"username": "victim_user",
"email": "victim@hacktarget.lab",
"role": "user"
}[1] Unprotected Profile Update
No CSRF token. No SameSite cookie. Accepts POST from any origin.
[2] Simulate CSRF Attack
Simulates a forged POST from evil.com — escalates role to administrator.