I was developing userscript that uploads files to Stack Exchange Imgur app account. What I discovered during development can be seen here.

The thing is that according to my test, any program can add images to the Stack Overflow account, as described in the post I linked to. All they have to do is that they parse/retrieve the 'fkey' from the stack overflow HTML - logged on or not. 1

My question is, why is the fkey being sent with requests if it doesn't protect the site? Does fkey pair with log-on status of the user?

Do you think there's actually a reason to protect SO imgur account? (@StevenV Now it's not protected and I think it might need some protection)

1: I actually didn't try to upload without the fkey, or using random value. There are indications that the server doesn't even check it.

  • 1
    Yeah, I think there's a need. It stops unsuspecting users from uploading random images from non-SE domains. – Steven V Dec 1 '14 at 16:52
  • Difference between the determination needed to investigate the request and the determination needed to find fkey is very low. XHR/<form> requests won't work due to CORS and HTTP_REFERRER header. – Tomáš Zato - Reinstate Monica Dec 1 '14 at 17:03
  • I asked a similar question here. My guess is close to Shadow Wizard's comment. – Dave Chen Dec 1 '14 at 18:22
  • @DaveChen I've read your question before already. I'll refer to it in my post (I wanted to but have forgotten) – Tomáš Zato - Reinstate Monica Dec 1 '14 at 18:28
  • 2
    Bottom line, what is the harm? I doubt imgur is charging Stack Exchange according to storage amount, and even if it is a factor, we talk about gigas. Few "rough" images won't really make a difference. – Shadow Wizard Wearing Mask Dec 1 '14 at 18:40
  • @ShadowWizard That's why I'm starting a discussion - not reporting a bug. My question is: "Do you think there's actually a reason to protect SO imgur account?". Because any protection brings some inconvenience for people like me. – Tomáš Zato - Reinstate Monica Dec 1 '14 at 18:43
  • 1
    Sure thing and you already got my +1, just stating my general opinion. Dev with some real stats can come with a better answer. :-) – Shadow Wizard Wearing Mask Dec 1 '14 at 19:28
  • The only issue I see with this is if some malicious people used SE's Imgur installation to serve massive amounts of inappropriate contents... also, unlike the original Imgur there isn't an obvious way (for someone who isn't on SE) of reporting such content. – user230564 Dec 2 '14 at 5:00

You must log in to answer this question.

Browse other questions tagged .