What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

How does Stack Overflow's markdown protect against CSRF attacks? For example, an image generated by markdown like:

![alt text][1]
  [1]: http://stackoverflow.com/users/logout

does not log the user off when viewed

share|improve this question

migrated from stackoverflow.com Jul 15 '10 at 1:18

This question came from our site for professional and enthusiast programmers.

1  
@Tomek - any chance of fixing the english in this question (to the same standard as your previous question: stackoverflow.com/questions/2872588/…), it's hard to understand what you're asking. –  Kev Jul 13 '10 at 17:28
1  
I'm fairly sure this does belong here, and not on meta. It uses SO as an example, but it's really a generic "how do you allow markdown securely" question –  Michael Mrozek Jul 13 '10 at 17:32

1 Answer 1

Have you tried following the link? Brings you to a page where you have to click buttons (which generates POST requests) to actually log out.

You cannot generate POST requests from <img /> tags. Which makes the WMD editor safe.

share|improve this answer
    
So what to do to prevent csrf in case of GET requests in markdown? –  Tomek Jul 13 '10 at 17:33
3  
@Tomek If you're allowing GET requests to change state you're doing it wrong; they should be POST requests –  Michael Mrozek Jul 13 '10 at 17:37
    
Thank you for your reply.. sorry for my english :) –  Tomek Jul 13 '10 at 17:56
    
Also, this isn't a Cross Site Request Forgery –  perbert Jul 15 '10 at 1:35

You must log in to answer this question.