Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The exercise isolates a CSRF enforcement gap: confirmation JavaScript reads postId and redirects to /post/ plus that value; ../my-account/change-email?email=hacked@hacker.com escapes the intended path. The important evidence is the browser’s cookie and navigation behavior, not merely that a cross-site form can be submitted.

Lab objective/setup

Exercise SameSite Strict bypass via client-side redirect through the endpoint and input recorded in the lab note. Confirmation JavaScript reads postId and redirects to /post/ plus that value; ../my-account/[email protected] escapes the intended path.

What I observed

confirmation JavaScript reads postId and redirects to /post/ plus that value; ../my-account/[email protected] escapes the intended path.

Lab description asks for a CSRF email change using the provided exploit server.
Lab description asks for a CSRF email change using the provided exploit server.
Burp shows GET /post/comment/confirmation?postId=9, the same-site confirmation route used as the redirect gadget.
Burp shows GET /post/comment/confirmation?postId=9, the same-site confirmation route used as the redirect gadget.

Why it is vulnerable

Confirmation JavaScript reads postId and redirects to /post/ plus that value; ../my-account/[email protected] escapes the intended path. The application passes that value into the security-sensitive operation without the context-specific validation or encoding needed to prevent this result.

Walkthrough in the authorized PortSwigger lab

Recreate the account-change flow, establish the normal request’s token and cookie requirements, then alter only the method, token presence, cookie age, redirect path, or sibling-origin step named in the evidence. The goal is to show exactly where the browser still supplies authority to the forged request.

Confirmation-page JavaScript reads postId and assigns window.location to the blog path plus /post/ and the unvalidated value.
Confirmation-page JavaScript reads postId and assigns window.location to the blog path plus /post/ and the unvalidated value.
The exploit-server script sends the victim to /post/comment/confirmation?postId=1/../../my-account/change-email?email=... so the client-side redirect becomes a same-site GET carrying the Strict session cookie.
The exploit-server script sends the victim to /post/comment/confirmation?postId=1/../../my-account/change-email?email=... so the client-side redirect becomes a same-site GET carrying the Strict session cookie.
The Academy banner for “SameSite Strict bypass via client-side redirect” shows Solved.
The Academy banner for “SameSite Strict bypass via client-side redirect” shows Solved.

Verification

The lab is confirmed when confirmation JavaScript reads postId and redirects to /post/ plus that value; ../my-account/[email protected] escapes the intended path. The captured result and the Academy solved state provide the verification; an ordinary status code alone does not.

Impact and defensive lesson

A production attacker could change victim account data while relying on ambient cookies. Validate CSRF tokens on every state-changing route and method, bind them to the authenticated session, set deliberate SameSite attributes, and remove redirect or sibling-origin gadgets that turn same-site navigation into cross-site request authority.

References