CSRF Token Bypass — State-Changing Request and Mitigation Audit

Hard GIAC GWEB cybersecurity drill: You are a Web Application Penetration Tester for OmniPay, a digital wallet service with 2.4M users. During a grey-box