DevPulse — CSRF via JSON Content-Type Bypass

hackadvisor

Task: Express.js developer analytics platform with JSON API settings endpoint, admin bot visits reported URLs, admin profile is private. Solution: CSRF via Content-Type bypass — the JSON API also accepts application/x-www-form-urlencoded, enabling a cross-origin form POST that bypasses SameSite=Lax as a top-level navigation to change admin's profile visibility to public.