Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It only takes a minute to sign up.
Sign up to join this community
I really don't understand the form_key feature. I have found several sites asking and dealing with issues about the form_key but none explained the reason for it's existence.
Everyone just worked around this "security feature" e.g. this one
Can anybody explain what the form_key is used for?
EDIT:
ok, I get the CSRF Vector for changing user data or anything beyond the cart and even the checkout.
But what could the possible attack on the cart be?!
It prevents Cross Site Request Forgery
Cross-Site Request Forgery (CSRF) is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (like sending a link via email/chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transfering funds, changing their email address, etc. If the victim is an administrative account, CSRF can compromise the entire web application.
(highlighting added)
