Skip to content
test sites

All tests / Forms & logins

CSRF token

What this tests. A form whose hidden token must come back with the cookie it was issued with. Replay it wrong and you get a 403.

Every time you load this page you get a new nw_csrf cookie and a hidden csrf_token field that belongs to it. Send them back together and the post goes through with a 303. Send a stale token, someone else's token, or no cookie, and you get a 403.