"Bad Request" when posting

lsayre wrote:Out of all of the posts and revisions to posts I've made today, I only saw the error message pop up once.

lsayre wrote:I knew I should have written it down. Something about an "incorrect form" perhaps. But when I pressed "submit" a second time it went through.

Cross-site request forgery



The attack works by including a link or script in a page that accesses a site to which the user is known (or is supposed) to have been authenticated.[1] For example, one user, Bob, might be browsing a chat forum where another user, Fred, has posted a message. Suppose that Fred has crafted an HTML image element that references an action on Bob's bank's website (rather than an image file), e.g.,

<img src="http://bank.example.com/withdraw?account=bob&amount=1000000&for=Fred">

If Bob's bank keeps his authentication information in a cookie, and if the cookie hasn't expired, then the attempt by Bob's browser to load the image will submit the withdrawal form with his cookie, thus authorizing a transaction without Bob's approval.

A cross-site request forgery is a confused deputy attack against a Web browser. The deputy in the bank example is Bob's Web browser which is confused into misusing Bob's authority at Fred's direction.

Code: Select all

<img src="http://nepacrossroads.com/posting.php?messgae=the mayor is an idiot">