I was developing userscript that uploads files to Stack Exchange Imgur app account. What I discovered during development can be seen here.
The thing is that according to my test, any program can add images to the Stack Overflow account, as described in the post I linked to. All they have to do is that they parse/retrieve the 'fkey' from the stack overflow HTML - logged on or not. 1
My question is, why is the
fkey being sent with requests if it doesn't protect the site? Does
fkey pair with log-on status of the user?
Do you think there's actually a reason to protect SO imgur account? (@StevenV Now it's not protected and I think it might need some protection)
1: I actually didn't try to upload without the
fkey, or using random value. There are indications that the server doesn't even check it.