What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

Possible Duplicate:
What is the fkey that’s present on some pages and what does it do?

I was looking into the HTML forms of Stack Overflow and I realized that it doesn't use AntiForgeryToken. So I created a localhost page with the forms of Stack Overflow, posted something and it worked.

So, why doesn't Stack Overflow use it?

share|improve this question

marked as duplicate by animuson, Rosinante, Martijn Pieters, Diago, Toon Krijthe Oct 25 '12 at 15:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
Why would it need to? –  Pops Oct 25 '12 at 12:29
    
I doubt it "worked". What exactly did this form do? What action did it perform? Any POST action must send some key to actually do anything. –  Shadow Wizard Oct 25 '12 at 12:29
    
I posted to /questions/ask/submit –  MuriloKunze Oct 25 '12 at 12:29
    
And why is that a problem that you could submit that question? –  Mat Oct 25 '12 at 12:30
    
@Popular Demand because I can create a malicious page that sends data when you access it. –  MuriloKunze Oct 25 '12 at 12:31
4  
@MuriloKunze: did that action of your bypass any restrictions? Can you do anything you wouldn't be able to do via the main site? –  Mat Oct 25 '12 at 12:32
1  
@MuriloKunze - are you sure that it would render "correctly" on the site? What you are posting is text for a question/answer. This is read out of the database and converted to HTML for display. I would be very surprised if what you input wasn't sanitised in some way most likely before storage in the database. –  ChrisF Oct 25 '12 at 12:33
1  
You posted to /questions/ask/submit and then what? Has a new question been created? If so, what question exactly? –  Shadow Wizard Oct 25 '12 at 12:35
1  
OK, here you go. –  Shadow Wizard Oct 25 '12 at 12:39
2  
There is a field for this; it's named fkey –  Andrew Barber Oct 25 '12 at 12:45
    
@Andrew Barber Yeah, I did not see it, Thank you very much. –  MuriloKunze Oct 25 '12 at 12:48
    
@pop, shawizdoward - in theory, a malicious site could indeed fill in a hidden form and post questions in he user's name wihout a token. –  Pëkka Oct 25 '12 at 13:28
    
@Pekka while I admit I wasn't sure about the technical details, my comment was primarily intended to hint to the OP that suggestions should come with justifications/rationales. Otherwise what's the difference between this and "why isn't SO's color scheme more blue," "why doesn't SO award nine points per upvote instead of ten".... –  Pops Oct 25 '12 at 14:13

1 Answer 1

up vote 3 down vote accepted

The Ask Question page does use tokens:

<div class="edit-block">
        <input id="fkey" name="fkey" type="hidden" value="********************************">
        <input id="author" name="author" type="text">
    <input type="hidden" name="i1l" value="********************************************">
</div>
share|improve this answer
    
Nice, I did not see it. –  MuriloKunze Oct 25 '12 at 12:49

Not the answer you're looking for? Browse other questions tagged .