CVE-2023-45857-Demo

Demo to verify the behavior of Axios vulnerability CVE-2023-45857

1. Start with dev container
2. Run npm run dev in the app container
3. Access http://app.localhost
4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools
   • The value is CREDENTIAL_TOKEN
   • HttpOnly is false
   • SameSite is Strict
5. Press the button
6. In the developer tools, check that the request to whoami.localhost/api has the header x-xsrf-token with the value CREDENTIAL_TOKEN
   • Since whoami returns the request as-is, you can also verify it in the browser