{
  "test": "csrf",
  "title": "CSRF token",
  "data_version": "1.0.0",
  "seed": 20261102,
  "page": "/forms/csrf/",
  "needs": "Needs cookies",
  "difficulty": "Medium",
  "what_it_tests": "A form whose hidden token must come back with the cookie it was issued with. Replay it wrong and you get a 403.",
  "expect": {
    "form": {
      "action": "/forms/csrf/",
      "method": "POST",
      "fields": [
        "csrf_token",
        "message"
      ]
    },
    "cookie": "nw_csrf",
    "rule": "GET /forms/csrf/ issues a fresh cookie and a matching hidden token. POST both back together.",
    "on_success": {
      "status": 303,
      "location": "/forms/csrf/accepted/"
    },
    "on_missing_or_wrong_token": {
      "status": 403
    },
    "on_missing_cookie": {
      "status": 403
    }
  },
  "records": [
    {
      "url": "/forms/csrf/accepted/",
      "code": "CSRF-OK"
    }
  ]
}