# Harborline — CSRF Account Takeover (lab)

> Harborline's POST /account/email changes the signed-in user's email for any request carrying a valid session cookie — no CSRF token, no SameSite cookie attribute.

Canonical: https://codelivly.com/labs/csrf-account-takeover

| | |
|---|---|
| Type | Web |
| Difficulty | Beginner |
| Points | 200 |
| Session length | 30 min |
| Completions | 1 |

Harborline's POST /account/email changes the signed-in user's email for any request carrying a valid session cookie — no CSRF token, no SameSite cookie attribute. Read the handler, add the missing checks, and prove it with the built-in checker.

## Objective

Learn to recognise and close a CSRF (cross-site request forgery) gap on a state-changing endpoint. A browser attaches cookies to a request automatically, even when that request was triggered by a completely different website — so an endpoint that trusts "a valid session cookie arrived" as its only check can be driven by a page the victim never meant to interact with. You will not be asked to build an attacker page; the lab shows you one and runs it for you. Your job is to patch the handler and the cookie it issues.

## Tasks

1. Open the lab and read the handler
2. See the risk, without crafting anything
3. Add the token check
4. Add SameSite to the cookie
5. Run the checker

## Related

- [All labs](https://codelivly.com/practice?type=lab)