Why should you care?

MarkupVerse wire transfers post over TLS with anti-CSRF and no password in URL.

See it live — copy this example

Save as demo.html and open in your browser, or use Run Example below.

<form action="https://bank.markupverse.app/wire" method="post" autocomplete="on">
  <input type="hidden" name="csrf" value="a8f3c2…">
  <label>Beneficiary IBAN
    <input name="iban" autocomplete="off" required pattern="[A-Z]{2}[0-9]{2}[A-Z0-9]{11,30}">
  </label>
  <label>Amount
    <input name="amount" type="number" min="1" step="0.01" inputmode="decimal" required>
  </label>
  <button type="submit">Authorize wire</button>
</form>

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• POST sensitive actions.
• Hidden CSRF token.
• autocomplete off on sensitive fields.
• pattern is UX hint only — validate server-side.

Practice next

1. Use method=post to HTTPS.
2. Add hidden csrf field.
3. pattern + required on IBAN.
4. Add autocomplete="one-time-code" for OTP field.
5. Use formnovalidate only on draft save.

Remember

HTTPS POST. CSRF token. Server validates all fields.

MarkupVerse wire form

Customer submits ₹50k wire.

Outcome: TLS + CSRF protect the transfer request.