Account Login

Scenario

Notification preferences toggle via a GET link with an enabled parameter. Merely visiting the URL flips the setting—no confirmation step. Turn notifications on using a cross-site request.

Your approach

1. While logged in, open the notifications page and note the GET URL pattern.
2. Craft a request with enabled set to true outside the app UI.
3. Optionally host an img tag pointing at that URL on another origin.
4. Verify notifications show as enabled and the lab reveals its flag.
5. Submit the task flag.