7

TL;DR: by storing the sort selection (active, newest, votes) in the page itself when getting a querystring parameter, SE is exposing its users to a possible CSRF attack which can change that sort without the users ever asking for this. I would like a change that will prevent such an option. What comes to mind is storing the selection in a separate AJAX call, after actually clicking the sort option we want to have. (Naturally a POST request, like all other actions.)


Taken from Wikipedia:

Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf1) or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts.

The default sort for answers, is by votes: (sample question)

The action of clicking a different tab, e.g. "active" is actually a command: "Change the answers sort order, and keep that selection". Users might not know the selection is stored and applied to all other questions they will visit, but that's a different story - they still actively asked for it. Hence the command has permanent effect.

Now, suppose someone sends me such a link. It looks innocent enough, link to a question on Stack Overflow. I click it, take a look, close the tab and forgets about it. However, when viewing other questions, with more than one answer, I suddenly realize something is really strange. The answers are all messed up, in the wrong order, as I never asked to change the order. It takes a really good set of eyes to notice this change:

This is exactly an "unauthorized command" as the above quote mentions.

Can this please be nullified, by changing the way how sort selection is stored? What I have in mind is moving the part responsible for storing the sort option to trigger only in response to a POST request, and invoking such a request in the click event of the tabs, before the page actually redirects.

This will cause that clicking such a link as above will still show the answers in the requested order, but won't store that order for future visits.

Worth to mention, this also applies to tag pages, e.g. after clicking such a link, you will always be in the "votes" tab, in all tags you visit on that site.

  • 3
    My favourite trick along these lines is ![](http://stackoverflow.com/?pagesize=1) – Jeremy Apr 12 '16 at 18:15
  • Yes, this is annoying, but it's hardly a security risk, so this might end up taking a back seat. – ArtOfCode Apr 13 '16 at 9:05
  • @ArtOfCode of course, not expecting anything, just thought that showing it as CSRF (which it really is, though indeed not really a "risk") might invoke a faster response. – Shadow 10 Years Wizard Apr 13 '16 at 9:33
  • @JeremyBanks LOL it really "works"!! – Shadow 10 Years Wizard Apr 13 '16 at 9:33

You must log in to answer this question.

Browse other questions tagged .