title: CSRF - Can forged POSTs contain arbitrary data?
body: <p>Forged POST requests can be constructed by untrusted websites by creating a form and posting it to the target site.  However, the raw contents of this POST will be encoded by the browser to be in the format:</p>
  
  <pre><code>param1=value1&amp;param2=value2
  </code></pre>
  
  <p>Is it possible for <em>untrusted websites</em> to construct forged POSTs which contain <em>arbitrary</em> raw content -- such as stringified JSON?</p>
  
  <pre><code>{param1: value1, param2: value2}
  </code></pre>
  
  <p>Put another way:  <strong>Can websites cause the browser to POST <em>arbitrary</em> content to third-party domains?</strong></p>