| Verifies external XSS-based form attacks via rogue requests | ||
| openAndWait | /admin/distributed/forward | (open a direct page into distributed forwarding) |
| type | //input[@name='_session'] | so_bad_its_good |
| clickAndWait | //input[@type='submit'] | |
| verifyText | //div[@class='errorHeader'] | Mismatched session ID provided; request refused |