== CSRF and content-type

In the previous section we saw how relying on the content-type is not a protection against
CSRF. In this section we will look into another way we can perform a CSRF attack against
a APIs which are not protected against CSRF.

In this assignment you need to achieve to POST the following JSON message to our endpoints:

[source]
----
POST /csrf/feedback/message HTTP/1.1

{
  "name"    : "WebGoat",
  "email"   : "webgoat@webgoat.org",
  "content" : "WebGoat is the best!!"
}
----

More information can be found http://pentestmonkey.net/blog/csrf-xml-post-request[here]

Remember you need to make the call from another origin (WebWolf can help here) and you need to be logged in into
WebGoat.
