Douban API 2.0 interface CSRF

Douban API V2 provides developers with interfaces to operate Douban accounts, although oauth2.0 authentication is required. However, some interfaces can be used as long as they are in the logon status and do not require authentication. The csrf vulnerability exists in the broadcast interface due to lax server restrictions. You can control the Douban login account to send arbitrary broadcasts. The development document describes that only POST is allowed, but the actual test shows that the GET method can directly send broadcasts, and oauth authentication is not required for users who have logged on to Douban.

In addition to sending text, you can also recommend URLs, push, and so on.Solution:Needless to say