Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 153 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

Possible Duplicate:
What is the fkey that’s present on some pages and what does it do?

I was looking into the HTML forms of Stack Overflow and I realized that it doesn't use AntiForgeryToken. So I created a localhost page with the forms of Stack Overflow, posted something and it worked.

So, why doesn't Stack Overflow use it?

share|improve this question

marked as duplicate by animuson, Rosinante, Martijn Pieters, BinaryMisfit, Toon Krijthe Oct 25 '12 at 15:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
Why would it need to? – Pops Oct 25 '12 at 12:29
    
I doubt it "worked". What exactly did this form do? What action did it perform? Any POST action must send some key to actually do anything. – Shadow Wizard Oct 25 '12 at 12:29
    
I posted to /questions/ask/submit – MuriloKunze Oct 25 '12 at 12:29
    
And why is that a problem that you could submit that question? – Mat Oct 25 '12 at 12:30
    
@Popular Demand because I can create a malicious page that sends data when you access it. – MuriloKunze Oct 25 '12 at 12:31
4  
@MuriloKunze: did that action of your bypass any restrictions? Can you do anything you wouldn't be able to do via the main site? – Mat Oct 25 '12 at 12:32
1  
@MuriloKunze - are you sure that it would render "correctly" on the site? What you are posting is text for a question/answer. This is read out of the database and converted to HTML for display. I would be very surprised if what you input wasn't sanitised in some way most likely before storage in the database. – ChrisF Oct 25 '12 at 12:33
1  
You posted to /questions/ask/submit and then what? Has a new question been created? If so, what question exactly? – Shadow Wizard Oct 25 '12 at 12:35
1  
OK, here you go. – Shadow Wizard Oct 25 '12 at 12:39
2  
There is a field for this; it's named fkey – Andrew Barber Oct 25 '12 at 12:45
    
@Andrew Barber Yeah, I did not see it, Thank you very much. – MuriloKunze Oct 25 '12 at 12:48
    
@pop, shawizdoward - in theory, a malicious site could indeed fill in a hidden form and post questions in he user's name wihout a token. – Pëkka Oct 25 '12 at 13:28
    
@Pekka while I admit I wasn't sure about the technical details, my comment was primarily intended to hint to the OP that suggestions should come with justifications/rationales. Otherwise what's the difference between this and "why isn't SO's color scheme more blue," "why doesn't SO award nine points per upvote instead of ten".... – Pops Oct 25 '12 at 14:13
up vote 3 down vote accepted

The Ask Question page does use tokens:

<div class="edit-block">
        <input id="fkey" name="fkey" type="hidden" value="********************************">
        <input id="author" name="author" type="text">
    <input type="hidden" name="i1l" value="********************************************">
</div>
share|improve this answer
    
Nice, I did not see it. – MuriloKunze Oct 25 '12 at 12:49

Not the answer you're looking for? Browse other questions tagged .