TL;DR: by storing the sort selection (active, newest, votes) in the page itself when getting a querystring parameter, SE is exposing its users to a possible CSRF attack which can change that sort without the users ever asking for this. I would like a change that will prevent such an option. What comes to mind is storing the selection in a separate AJAX call, after actually clicking the sort option we want to have. (Naturally a POST request, like all other actions.)
Taken from Wikipedia:
Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf1) or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts.
The default sort for answers, is by votes: (sample question)
The action of clicking a different tab, e.g. "active" is actually a command: "Change the answers sort order, and keep that selection". Users might not know the selection is stored and applied to all other questions they will visit, but that's a different story - they still actively asked for it. Hence the command has permanent effect.
Now, suppose someone sends me such a link. It looks innocent enough, link to a question on Stack Overflow. I click it, take a look, close the tab and forgets about it. However, when viewing other questions, with more than one answer, I suddenly realize something is really strange. The answers are all messed up, in the wrong order, as I never asked to change the order. It takes a really good set of eyes to notice this change:
This is exactly an "unauthorized command" as the above quote mentions.
Can this please be nullified, by changing the way how sort selection is stored? What I have in mind is moving the part responsible for storing the sort option to trigger only in response to a POST request, and invoking such a request in the click event of the tabs, before the page actually redirects. For GET requests, the sort selection should only be used on that specific page load and not saved on the server, to allow for linking to specific sort selections.
Worth to mention, this also applies to tag pages, e.g. after clicking such a link, you will always be in the "votes" tab, in all tags you visit on that site.