6

Looking at this question, it seems fkey is a token to prevent other people from automating actions from a remote webpage.

The frame where the token exists is from the Upload Image dialog.

I did a quick test:

  1. I logged of my account
  2. Cleared all cookies and cache
  3. Viewed a random question
  4. Opened the upload dialog
  5. From tools, I deleted fkey
  6. I submitted an image link
  7. It worked fine

Here is the exact request I sent,

POST /upload/image HTTP/1.1
Host: stackoverflow.com
Connection: keep-alive
Content-Length: 260
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://stackoverflow.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1592.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary0DRnPMMdEZTwYLqs
Referer: http://stackoverflow.com/questions/18169634/automatic-deployment-to-specific-folder
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,ja;q=0.6,zh-TW;q=0.4,zh;q=0.2

Request Payload:

------WebKitFormBoundary0DRnPMMdEZTwYLqs
Content-Disposition: form-data; name="upload-url"

http://puu.sh/3Z8Mk.png
------WebKitFormBoundary0DRnPMMdEZTwYLqs
Content-Disposition: form-data; name="source"

web
------WebKitFormBoundary0DRnPMMdEZTwYLqs--

The response was normal:

<html>
<head>
<script type='text/javascript'>
  var error = null; 
  var result = 'http://i.stack.imgur.com/3PH0K.png';
  if (error == null) {
     window.parent.closeDialog(result);
  } else {
     window.parent.displayUploadError(error); 
  }
</script>
</head>
<body></body>
</html>

So why is there fkey, but it doesn't do anything to prevent XSRF?

Here is the code an attacker could use:

<form action="http://stackoverflow.com/upload/image" method="post" enctype="multipart/form-data">
    <input type="text" name="upload-url">
    <input type="hidden" name="source" value="web">
    <input type="submit" value="Add picture">
</form>

Once the form is submitted, you can see that the response appears to be an empty page. View the source and you can see the JavaScript returning the i.stack. image.

  • As far as I know, it's used to verify your identity. Currently there's no relation whatsoever between image upload and who is uploading meaning there's no way to know who uploaded each image so the fkey is indeed meaningless in this context. :) – Shadow9 Aug 11 '13 at 7:44
  • @ShaWizDowArd: Sorry for being off-topic, but I just wrote on your profile page! Cheers – Dave Chen Aug 11 '13 at 7:53
  • Lol! You hacked my keyboard! :) Hello to you too! By the way, tried to upload image from a standalone form on my own machine and got "Suspicious Request" error, guess they're using the referrer as well. – Shadow9 Aug 11 '13 at 8:02

You must log in to answer this question.

Browse other questions tagged .