What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

I am a bit reluctant to ask this question since it may appear sinister (or that it may belong to SO), but my curiosity has peaked: I'm wondering what the "fkey" does that gets sent with a new comment.

I read here that using a token can help prevent some forms of session hijacking. I would like to understand how that process works. Is the "fkey" an example of this? I don't need or want a detailed description of what SO does with the "fkey"; I would like an overview of the technical aspects of such security a technique (if my assumptions are correct) and any further reading.

Perhaps this question is better suited for SO, but it seems as relevant to SO as it is to the backdrop of the topic.

share|improve this question
    
Thanks for your question. I would actually like to know Stackexchange's implementation of this fkey. It's used everywhere in their js and sent in post requests. –  David Xia Jul 6 '11 at 4:18
    
@David, I would to. I haven't had a chance to do any further research, but I plan to tackling this issue at some point when I have time. If you make any further progress, please share by writing a comment here with @Mohamad in the first line, or posting a whole new answer. –  Mohamad Jul 6 '11 at 15:04

1 Answer 1

up vote 4 down vote accepted

XSRF protection. Something that can't be known to an attacker (it is different per user). Cookies are #fail because the browser will add them implicitly.

See "prevention" on that page:

  • Requiring a secret, user-specific token in all form submissions and side-effect URLs prevents CSRF; the attacker's site cannot put the right token in its submissions
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .