I encountered a similar problem at work recently. The first thing come to my mind is CSRF. But it can be bypassed by parsing the token in HTML. Then I found th

I encountered a similar problem at work recently. The first thing come to my mind is CSRF. But it can be bypassed by parsing the token in HTML. Then I found this article[1]. Embedding a challenging with valid time in Javascript, calculating the response by obfuscated Javascript code. [1] "Bypassing YouTube video download throttling" https://news.ycombinator.com/item?id=37117338 https://news.ycombinator.com/item?id=37117338