Submit a CSRF-protected form

POSThttps://api.testingapis.com/api/auth/csrf/submitSign in to see this endpoint's URL

Submit a CSRF-protected form (double-submit cookie check).

Requires the XSRF-TOKEN cookie from GET /api/auth/csrf/token and a matching X-CSRF-Token header.Requires the XSRF-TOKEN cookie from GET … and a matching X-CSRF-Token header.

Note: Call GET /api/auth/csrf/token first; send its token in X-CSRF-Token and keep the cookie it sets. The token must be one this server issued: tokens are signed, so a made-up value fails even when the cookie and header match.Note: Call GET … first; send its token in X-CSRF-Token and keep the cookie it sets. The token must be one this server issued: tokens are signed, so a made-up value fails even when the cookie and header match.

CSRF double-submit: X-CSRF-Token header must match the XSRF-TOKEN cookie

Parameters 1

Name	Type	Description
`X-CSRF-Token`required	header · string	Token from GET /api/auth/csrf/token (the matching cookie is sent automatically by the browser).Token from GET … (the matching cookie is sent automatically by the browser).

Request body

Optional. application/json. Any body.

Example body

{"comment": "hello"}

Responses

200: Cookie and header match.
403: Cookie or header missing, they don't match, or the token wasn't issued by this server.

Example

Request

curl -X POST "https://api.testingapis.com/api/auth/csrf/submit" \
  -H "Content-Type: application/json" \
  -H "X-CSRF-Token: {{csrfToken}}" \
  -H "Cookie: XSRF-TOKEN={{csrfToken}}" \
  -d '{"comment": "hello"}' \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

{"message": "CSRF check passed. Form submitted.", "submittedAt": "2026-09-30T18:26:45Z"}

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl -X POST 'https://api.testingapis.com/api/auth/csrf/submit' \
  -H 'X-CSRF-Token: {{csrfToken}}' \
  -H 'Content-Type: application/json' \
  -H 'X-TestingApis-Key: YOUR_API_KEY' \
  -d '{"comment": "hello"}'

const res = await fetch("https://api.testingapis.com/api/auth/csrf/submit", {
  method: "POST",
  headers: {
    "X-CSRF-Token": "{{csrfToken}}",
    "Content-Type": "application/json",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: "{\"comment\": \"hello\"}",
});
console.log(res.status, await res.text());

// The shape of the example response in the docs.
type ApiResponse = {
  message: string;
  submittedAt: string;
};

const res = await fetch("https://api.testingapis.com/api/auth/csrf/submit", {
  method: "POST",
  headers: {
    "X-CSRF-Token": "{{csrfToken}}",
    "Content-Type": "application/json",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: "{\"comment\": \"hello\"}",
});
const body = (await res.json()) as ApiResponse;
console.log(res.status, body);

import requests

res = requests.post(
    "https://api.testingapis.com/api/auth/csrf/submit",
    headers={
        "X-CSRF-Token": "{{csrfToken}}",
        "Content-Type": "application/json",
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
    data="{\"comment\": \"hello\"}",
)
print(res.status_code, res.text)

using System.Net.Http.Headers;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.testingapis.com/api/auth/csrf/submit");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "{{csrfToken}}");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
request.Content = new StringContent("{\"comment\": \"hello\"}");
request.Content.Headers.ContentType = MediaTypeHeaderValue.Parse("application/json");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/auth/csrf/submit"))
                .header("X-CSRF-Token", "{{csrfToken}}")
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .header("Content-Type", "application/json")
                .method("POST", HttpRequest.BodyPublishers.ofString("{\"comment\": \"hello\"}"))
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader("{\"comment\": \"hello\"}")
	req, err := http.NewRequest("POST", "https://api.testingapis.com/api/auth/csrf/submit", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-CSRF-Token", "{{csrfToken}}")
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	req.Header.Set("Content-Type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}

CSRF double-submit: X-CSRF-Token header must match the XSRF-TOKEN cookie

CSRF token{{csrfToken}}

GET /api/auth/csrf/token. The matching cookie cannot be sent from this page.

POSThttps://api.testingapis.com/api/auth/csrf/submit

Query

Headers

X-CSRF-Tokenrequiredstring

Browsers do not let pages set this header, so it is not sent.

Body

Browsers do not send cookies to another site, so endpoints that read cookies will not see them from this page. The curl example works.