19

TL;DR: by storing the sort selection (active, newest, votes) in the page itself when getting a querystring parameter, SE is exposing its users to a possible CSRF attack which can change that sort without the users ever asking for this. I would like a change that will prevent such an option. What comes to mind is storing the selection in a separate AJAX call, after actually clicking the sort option we want to have. (Naturally a POST request, like all other actions.)


Taken from Wikipedia:

Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf1) or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts.

The default sort for answers, is by votes: (sample question)

The action of clicking a different tab, e.g. "active" is actually a command: "Change the answers sort order, and keep that selection". Users might not know the selection is stored and applied to all other questions they will visit, but that's a different story - they still actively asked for it. Hence the command has permanent effect.

Now, suppose someone sends me such a link. It looks innocent enough, link to a question on Stack Overflow. I click it, take a look, close the tab and forgets about it. However, when viewing other questions, with more than one answer, I suddenly realize something is really strange. The answers are all messed up, in the wrong order, as I never asked to change the order. It takes a really good set of eyes to notice this change:

This is exactly an "unauthorized command" as the above quote mentions.

Can this please be nullified, by changing the way how sort selection is stored? What I have in mind is moving the part responsible for storing the sort option to trigger only in response to a POST request, and invoking such a request in the click event of the tabs, before the page actually redirects. For GET requests, the sort selection should only be used on that specific page load and not saved on the server, to allow for linking to specific sort selections.

Worth to mention, this also applies to tag pages, e.g. after clicking such a link, you will always be in the "votes" tab, in all tags you visit on that site.

8
  • 5
    My favourite trick along these lines is ![](http://stackoverflow.com/?pagesize=1)
    – Jeremy
    Apr 12, 2016 at 18:15
  • Yes, this is annoying, but it's hardly a security risk, so this might end up taking a back seat.
    – ArtOfCode
    Apr 13, 2016 at 9:05
  • @ArtOfCode of course, not expecting anything, just thought that showing it as CSRF (which it really is, though indeed not really a "risk") might invoke a faster response. Apr 13, 2016 at 9:33
  • @JeremyBanks LOL it really "works"!! Apr 13, 2016 at 9:33
  • 2
    This seems like a bug in the UI implementation. It's almost certainly not an intended side effect of the implementation, that a user's persistent sort choice can be hijacked and changed subtly, without their knowledge. Can this be tagged [bug]? Maybe it might get more attention than it has in the last 5 years...
    – scottbb
    Oct 15, 2021 at 15:15
  • 1
    @scottbb thanks, don't think it will make a difference but I've added the tag. Oct 15, 2021 at 16:23
  • Related (a different and much worse security exploit that can be used alongside this one to mess with people) Oct 15, 2021 at 16:24
  • @RedwolfPrograms yes, but..... images are a whole can of worms. Pandora box. This here is something really minor, compared, and so much easier to fix/change. :/ Oct 16, 2021 at 10:19

0

You must log in to answer this question.

Browse other questions tagged .