What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 150 Stack Exchange communities.

Possible Duplicate:
What is the fkey that’s present on some pages and what does it do?

I was looking into the HTML forms of Stack Overflow and I realized that it doesn't use AntiForgeryToken. So I created a localhost page with the forms of Stack Overflow, posted something and it worked.

So, why doesn't Stack Overflow use it?

share|improve this question

marked as duplicate by animuson, Rosinante, Martijn Pieters, BinaryMisfit, Toon Krijthe Oct 25 '12 at 15:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Why would it need to? – Pops Oct 25 '12 at 12:29
I doubt it "worked". What exactly did this form do? What action did it perform? Any POST action must send some key to actually do anything. – Shadow Wizard Oct 25 '12 at 12:29
I posted to /questions/ask/submit – MuriloKunze Oct 25 '12 at 12:29
And why is that a problem that you could submit that question? – Mat Oct 25 '12 at 12:30
@Popular Demand because I can create a malicious page that sends data when you access it. – MuriloKunze Oct 25 '12 at 12:31
@MuriloKunze: did that action of your bypass any restrictions? Can you do anything you wouldn't be able to do via the main site? – Mat Oct 25 '12 at 12:32
@MuriloKunze - are you sure that it would render "correctly" on the site? What you are posting is text for a question/answer. This is read out of the database and converted to HTML for display. I would be very surprised if what you input wasn't sanitised in some way most likely before storage in the database. – ChrisF Oct 25 '12 at 12:33
You posted to /questions/ask/submit and then what? Has a new question been created? If so, what question exactly? – Shadow Wizard Oct 25 '12 at 12:35
OK, here you go. – Shadow Wizard Oct 25 '12 at 12:39
There is a field for this; it's named fkey – Andrew Barber Oct 25 '12 at 12:45
@Andrew Barber Yeah, I did not see it, Thank you very much. – MuriloKunze Oct 25 '12 at 12:48
@pop, shawizdoward - in theory, a malicious site could indeed fill in a hidden form and post questions in he user's name wihout a token. – Pëkka Oct 25 '12 at 13:28
@Pekka while I admit I wasn't sure about the technical details, my comment was primarily intended to hint to the OP that suggestions should come with justifications/rationales. Otherwise what's the difference between this and "why isn't SO's color scheme more blue," "why doesn't SO award nine points per upvote instead of ten".... – Pops Oct 25 '12 at 14:13

1 Answer 1

up vote 3 down vote accepted

The Ask Question page does use tokens:

<div class="edit-block">
        <input id="fkey" name="fkey" type="hidden" value="********************************">
        <input id="author" name="author" type="text">
    <input type="hidden" name="i1l" value="********************************************">
share|improve this answer
Nice, I did not see it. – MuriloKunze Oct 25 '12 at 12:49

Not the answer you're looking for? Browse other questions tagged .