I'm playing around with a self-xss bug that I believe I can escalate with a CSRF attack. However, the exploit relies on sending two identical
Content-Length headers in a single POST request.
POST /authenticate[xss payload] Host: target.net Content-Length: 4 Content-Length: 4 whatever=whatever
It doesn't matter if the Content-Length is correct or not - there just has to be two identical Content-Length headers.
Sorry if the answer to this is trivial, I hope you can cut an infosec n00b some slack.