How To Use Kunststube-CSRFP?
<p>I put <a href="https://github.com/deceze/Kunststube-CSRFP" rel="nofollow">Kunststube-CSRFP</a> demo.php on my server : <code>http://domain1.com/demo.php</code> and hit 'TRY IT' button and it says : <strong>Form submission ok.</strong></p>

<p>then I look at the source code and copy the token generated by the script into another server (domain2.com) and try to make fake HTML form there :</p>

<pre><code>&lt;form action="http://domain1.com/demo.php" method="POST"&gt;
&lt;input type="hidden" value="1356266422:QaAnM2IolCk9K1Mme3rOGifwmfmdldzdyg/PBu4ht818lIu52ArKFG2HxUOztmcgwblLcIgymaNheuGY7g6Kg==:nvhnqxfM9upP/UT+FRGf0nXDILFPHaubfdjahVYSm2w9fFHKQ/bQQ6rapjdKN8ype9qaX8TkAZJpxg9RmH8ZM9YWA==" name="_token"&gt;
&lt;input type="submit" value="Submit"&gt;
&lt;/form&gt;
</code></pre>

<p>and when I hit 'Submit' button from domain2.php... surprisingly, demo.php on first server (domain1.com) process the token just like from itself and display same string : <strong>Form submission ok.</strong></p>

<p>shouldn't be "<strong>Token INVALID.</strong>" come out if it's not submitted from same server? where did I go wrong? thanks!</p>
