2

How does Stack Overflow's markdown protect against CSRF attacks? For example, an image generated by markdown like:

![alt text][1]
  [1]: http://stackoverflow.com/users/logout

does not log the user off when viewed

migrated from stackoverflow.com Jul 15 '10 at 1:18

This question came from our site for professional and enthusiast programmers.

  • 1
    @Tomek - any chance of fixing the english in this question (to the same standard as your previous question: stackoverflow.com/questions/2872588/…), it's hard to understand what you're asking. – Kev Jul 13 '10 at 17:28
  • 1
    I'm fairly sure this does belong here, and not on meta. It uses SO as an example, but it's really a generic "how do you allow markdown securely" question – Michael Mrozek Jul 13 '10 at 17:32
5

Have you tried following the link? Brings you to a page where you have to click buttons (which generates POST requests) to actually log out.

You cannot generate POST requests from <img /> tags. Which makes the WMD editor safe.

  • So what to do to prevent csrf in case of GET requests in markdown? – Tomek Jul 13 '10 at 17:33
  • 3
    @Tomek If you're allowing GET requests to change state you're doing it wrong; they should be POST requests – Michael Mrozek Jul 13 '10 at 17:37
  • Thank you for your reply.. sorry for my english :) – Tomek Jul 13 '10 at 17:56
  • Also, this isn't a Cross Site Request Forgery – perbert Jul 15 '10 at 1:35

You must log in to answer this question.