Tag: HTTP Methods

An Unusual CSRF: Changing the Method Wipes the Account

// TL;DR On a private program (I’ll call the target redacted.com), I went looking for an email-change CSRF. The email-change action was protected against CSRF on…