15

I was trying to cast a plagiarism flag but got a 500 error when doing so. Specifically I was flagging a question in the Staging Ground. I'm not sure if this bug is specific to the Staging Ground or applies to main site posts as well since I haven't had the chance to use the new flag before this.

1 Answer 1

14

I flagged a post for plagiarism on the main site and it went through with no problem. I retracted it immediately after.

I also tried to flag a post in Staging Ground for plagiarism and received an error.

Looking at the network tab, casting the plagiarism flag did POST https://stackoverflow.com/flags/posts/79254037/add/PlagiarizedContent (with a payload of the information I filled in) which returned a 302 redirect to the /error page which then returns a 500 error:

Browser developer tools showing a request for a plagiarised content flag then an error

The payload for the flag request was:

fkey=<my fkey>&otherText=test+test+test&customData=%7B%22plagiarizedSource%22%3A%22this+is+only+a+test%22%7D&overrideWarning=true
4
  • What is an "fkey" in this context? Commented Dec 5 at 10:53
  • 1
    @KarlKnechtel unique token for each user. It's sent with some actions to identify who is doing this. For example flags use the fkey. It's specific to Stack Exchange.
    – VLAZ
    Commented Dec 5 at 11:01
  • 4
    @KarlKnechtel See: Cross-site request forgery: Synchronizer token pattern. The cookies identify your session (who you are), while the CSRF token, which is paired with the cookie's session ID, verifies it's a request that at least had access to the HTML which was sent by the server. Both the values in your cookies and the CSRF token (fkey on SE) are required for POST requests made to the SE servers (including chat). The SE API doesn't use them, but has access_token values identifying the user+application pair.
    – Makyen Mod
    Commented Dec 5 at 15:17
  • 5
    While you shouldn't disclose your fkey value, as doing so does reduce security for you, disclosure of the fkey alone doesn't give access to your account, as the cookies stored in your browser are also needed.
    – Makyen Mod
    Commented Dec 5 at 15:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .