CSRF attack detected.

[tech-wreck]

trying to post on my android phone using chrome (because the ABP browser is buggy as ****), i get the message (in title) in red every time.
what? and, what?

 

[ss202sl]

http://en.wikipedia.org/wiki/Cross-site_request_forgery

 

[tech-wreck]

so... am i getting hacked, or is tom's?

or is nobody getting hacked, it's just the security software having an anxiety attack?

 

[ssddx]

i would say that nobody is getting hacked but that something in your posts is causing the security software to get tripped.

what specifically were you trying to post? does it trigger even on simple word posts without images or other script or is any attempt to post triggering it?

does the same occur on other browsers such as miren, firefox, etc?

are you running any extensions via chrome like adblock, scripblocker, etc?

the more info you provide the better able we are to try and figure out what the issue is.

 

[tech-wreck]

okay, tom's hardware is pretty much read-only on my phone now... i can't even reply to a thread now, it redirects to the desktop site; my text (just text, no images or code) is in the reply box, but not submitted.

my phone is the kitkat version, running the adblockplus app, not a chrome extension.

i'm posting this from a windows PC, firefox with the ABP add-on, and that seems to be working.

maybe the first assault of the war on adblockers will be fought on the mobile battlefield, and i'm limited to posting from a computer for now...

...hang on, let me try something else...

 

[tech-wreck]

okay. i have turned my phone's wifi off, the ABP app only works through wifi.

 

[tech-wreck]

the above post was from my phone. your security software doesn't like AdBlockPlus. i don't like ads. i also don't like using mobile data when wifi is available.

where do we go from here?

 

[Someone Somewhere]

Are you using any particularly unusual extra lists on ABP?

Any Javascript blockers?

Finally, try reloading a few times. I've seen weird stuff happen with the CSS recently.

 

[tech-wreck]

using just the 'easylist'. javascript? if it isn't factory installed, it's not installed.

and just tried to post ^that from my phone (mobile data) and got redirected to the mobile site again, with my text in the reply box, again. so, back to the computer...

 

[randomizer]

This is pretty odd. I wouldn't expect ABP to be interfering with CSRF protection because it's just a bunch of hidden inputs that have nothing to do with ads.

 

[tech-wreck]

now i have seen it happen independant of ABP, i'm inclined to agree...

 

[randomizer]

Maybe your session is in an invalid state. Try logging out (and maybe clear cookies for tomshardware.com and bestofmedia.com) and back in to create a new one. Yes, this is the "turn it of and on again" suggestion.

 

[tech-wreck]

cleared chrome's cache, cookies and browsing history. logged out, restarted chrome, logged back into tom's (on my phone) and tried to post.

and then it wants me to login again... so, entered my username, and in some nice red lettering it says "This username is unavailable"

what the actual, real-life F?

 

[Someone Somewhere]

Are you certain you're on the signin screen and not the signup screen?

You can also sign in with your email, though I don't know if that will make a difference...

 

[tech-wreck]

yep, definitely the sign in screen. and now i can't even get past that. i tried a different password just to check i was entering it right (came up invalid that time).
when i hit 'sign in', it's as though i had hit reload instead.
never tried with email, always signed in with username. i'll give it a go now...
edit: no joy, same result.

 

[randomizer]

and then it wants me to login again... so, entered my username, and in some nice red lettering it says "This username is unavailable"

That sounds like the registration page to me, though it could be a bug. What is the URL of the page you are on?

when i hit 'sign in', it's as though i had hit reload instead.

Are you using LastPass or any other password manager that fills in your credentials automatically?

 

[tech-wreck]

didn't catch the URL but the big red button said 'sign in' not 'sign up'

it gets curiouser: just reloaded tom's (on phone) from the bookmark, saw i was signed in, and was able to reply to a post in another thread i started yesterday (from this PC).

 

[tech-wreck]

test.

posted from my android.

let's see if an edit works...

so far, so good.

 

[tech-wreck]

i think 'turning it off and on again' has worked.
i posted a test thread which can be safely deleted (testing, one-two, testing)

thanks, randomizer, BA selected

 

[randomizer]

See, it's not just an IT joke Hopefully the issue doesn't recur.

 

[tech-wreck]

if it does, i know how to fix it

thinking about it, this phone had been logged in to tom's since i got it... five months ago LOL

edit: i ought to clear the crap out more often, it all seems faster now...

 

[ssddx]

as a side note:

when you're logged in you should not get any ads on the forum itself, only the homepage/articles.