Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Capture the secure form
Open /forms/secure through the auth recorder as User A. Inspect SameSite cookie behavior, method, content type, and the academy-csrf-token field.
Forge the request
Use CSRF Forge to create POST /api/preferences-secure without the token. Replay as User A and preserve the 403 response.
Test the vulnerable pair
Send the same request to preferences-insecure. Verify the preference changes and updatedBy identifies User A.
Check real-world conditions
For a real target, confirm browser delivery, cookie SameSite rules, Origin/Referer validation, content type, and user impact. A raw request alone does not prove browser-exploitable CSRF.
Prove it before moving on.
The lab evidence contains the captured form, forged request, secure rejection, vulnerable state change, and browser-delivery reasoning.