Walkthrough
Everything interesting here happens in the network panel — open it first, then:
- Watch what the client sends. Submit, click the
submitrequest, and open its payload. Alongside the form values sitcsrf: demo-token— a hidden field round-tripped byte for byte — andtoken: tok_123, injected by a pre-submit hook and found in no markup anywhere. Select two colors first andcolorsarrives as an array; the compound name arrives as two fields. What the server receives is not just the fields on the screen. - Watch what the server answers. The same request's response is the protocol's envelope:
{"formsanity": 2, "status": "accepted", "message": "Thanks!"}. The green banner is the client rendering it. - Watch a rejection round-trip. Follow the invalid link above, submit again, and the request goes red with a 422. Its response carries an
errorsarray naming the email field — and the page has rendered that exact error as a bubble on the email field. A server-side verdict finding its way back to the right control is the protocol's other half. - The other two scenarios. redirect: the accepted envelope carries a redirect and the client follows it. error: a 500, and the status region takes its failure state instead of pretending.
- The unique sub-protocol, no submit needed. Put
taken@example.comin Email and press Tab: auniquerequest fires and the field flags "already in use". Do it three times fast and the third request is a 429 — the mock rate-limits on purpose, and the client backs off silently rather than flag a field it could not check.