Cross-Site POST Requests Without a Content-Type Header / nastystereo.com

https://nastystereo.com/security/cross-site-post-without-content-type.html