Hacker News Reader

I'm sure PayPal is using some form or CSRF protection to prevent a POST from some external site from working.

There's a CSRF token in the form, but deleting it doesn't seem to cause the search to fail.

It's a search form.

It seems quite possible that CSRF checks could have been omitted in not expecting this to be a source of woe. Just goes to show... :P