Welcome back
This page publishes its own canonical URL (used for share links and as the CDN cache key). The URL is derived from the request host, so the intended host is pinned by the page — rewrite it with an intercepting proxy.
Canonical URL emitted for this page
https://www.playground.cspshivam.com/welcome
Canonical host is the legitimate site — nothing poisoned.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.