When you ask a question on SO, you can add images. One of the options for adding images is to add them based on a URL. SO wouldn't be able to just accept any URL for an image, however.

For instance, if someone created a site that required basic http authentication in order to serve up the image, then they used that image's URL in their SO question, everyone who navigated to that question in their browser would be presented with a username/password dialog, presenting a security risk to SO users.

That being said, I'm curious as to how SO handles URL-based images in questions. The site must proxy these images somehow, right?


To help clarify, let's say a hacker sets up a little server which requires basic authentication. Then, when creating a question, or posting an answer, he adds an image from a URL, and for the image URL he enters a URL that points to his little server, such as: "http://myhackingserver.com/someimage.jpg". In this scenario, if the site just rendered <img src="http://myhackingserver.com/someimage.jpg" /> onto the page, any user viewing the page would be presented with a username/password dialog. It's a phishing-style attack.

  • 1
    A username/password dialog would be annoying, but how would it be a security risk to the person browsing?
    – David Z
    Commented Dec 7, 2011 at 18:10
  • 10
    The dialog would appear as if it's a dialog generated by SO. It might trick users into entering their username/password. At that point, the hacker could gather up username/password combinations. Commented Dec 7, 2011 at 18:17
  • 1
    OK, I see, although I would think modern browsers should identify the source of the dialog in some way. As I recall in Firefox it starts out by saying "The page at http://whatever... wants to know" which would indicate that it's not Stack Overflow asking for the password. (And yes, I know people don't read things, but you can't entirely blame the site or the browser for that) Besides, I'm not even sure that browsers will put up the authentication dialog for images; they may just fail to display.
    – David Z
    Commented Dec 7, 2011 at 18:34
  • No dialog appears in Chrome when I embed an image requiring HTTP authentication. I remember this being an issue in the past, but maybe some browsers have fixed it. I agree that Stack Overflow mirroring all embedded images might be a good idea.
    – Jeremy
    Commented Dec 7, 2011 at 18:34
  • @BrandonMontgomery see my answer.
    – Naftali
    Commented Dec 7, 2011 at 18:53
  • FF and IE both present the user with the auth dialog on this question now. Commented Dec 7, 2011 at 19:20
  • @BrandonMontgomery due to the script in my answer.... :-P
    – Naftali
    Commented Dec 7, 2011 at 19:44
  • 2
    Related: Images in posts are a privacy threat
    – Jeremy
    Commented Dec 7, 2011 at 20:22

3 Answers 3


You can test it here.

That was just as easy as a simple php script:

if (!isset($_SERVER['PHP_AUTH_USER'])) {
    header('WWW-Authenticate: Basic realm="Stack Overflow"');
    header('HTTP/1.0 401 Unauthorized');
    header("Content-type: image/jpg");
       echo file_get_contents("hacked.jpg");   
} else {
    header("Content-type: image/gif");
       echo file_get_contents("block.gif");    

An image of a box should show up if you fake logged-in otherwise it states that you were hacked.

It seems that the SE just takes the images as they are, no matter how much they can damage the page.

  • ...except on Chrome, which apparently just doesn't show the dialog. Commented Dec 7, 2011 at 19:40
  • @BrandonMontgomery I saw the dialog in Chrome. What image do you see?
    – Naftali
    Commented Dec 7, 2011 at 19:42
  • 3
    I don't get a dialog on Chrome; I do get one on FF. But it says A username and password are being requested by http://www.blipit.net. Commented Dec 7, 2011 at 19:57
  • 1
    @ProblematicTitleException I know that. and if you click cancel you see a different image than if you click ok. Also it is very easy to add some backend to take the info that people enter in. (people sometimes don't even pay attention that the dialog is not from the page they are on)
    – Naftali
    Commented Dec 7, 2011 at 20:10
  • @AMan - I get one on Chrome if I open it in a new tab; it's a dropdown dialog. Clicking "Cancel" produces "You have been hacked". Entering (fake) credentials results in a cube. Commented Dec 7, 2011 at 20:10
  • @KevinVermeer yep. odd that it shows up in some browsers and not others (I dont know what you mean by a dropdown)
    – Naftali
    Commented Dec 7, 2011 at 20:11
  • I get a http auth dialog and a redirection on Chrome 87 (or whatever the latest stable version is.) Ugh, good work!
    – Pekka
    Commented Dec 7, 2011 at 20:35
  • Well I am on dev Chrome (17.0.963.0) and I see the dialog
    – Naftali
    Commented Dec 7, 2011 at 20:36
  • 1
    @Aman - i.sstatic.net/s6ozS.png Commented Dec 7, 2011 at 20:39
  • @KevinVermeer thats ur browser :-P its different on every browser
    – Naftali
    Commented Dec 7, 2011 at 20:48
  • @Shog9 the edit is not as beautiful as seeing it happen on this page, but I'll take it for now :-D
    – Naftali
    Commented Dec 7, 2011 at 20:50
  • It's waaaay less annoying though, @Amana... And it's also what would almost certainly happen in short order if you actually tried this on the main site (similar things have been done before).
    – Shog9
    Commented Dec 7, 2011 at 20:52
  • @Shog9 yea I remember something like this happening earlier on this year, I just can't remember when.
    – Naftali
    Commented Dec 7, 2011 at 20:53

If you add the image using the toolbar on the top of the text area to enter a post's text, the image is copied from the server to the server used for images on Stack Exchange sites. Supposing that it works in the case you are describing, the user who is adding the image is asked for the credentials, and then the image is uploaded in the server normally used for images.

If you are adding the image through the <img> tag, then you just write the URL as you would normally do, considering that the default values for the attributes are the following ones:

  • src=""
  • width="" (up to 999)
  • height="" (up to 999)
  • alt=""
  • title=""

In this case, there isn't any proxy that Stack Exchange uses; the URL you use is used as it is.

  • You don't need an <img> tag; a regular markdown image works just as well.
    – balpha StaffMod
    Commented Dec 8, 2011 at 9:33

If you view the page source it's just an <img> tag, which doesn't allow for the display of arbitrary HTML. If your browser did that then you would blame the browser, not the website. Am I missing something here?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .