1

I have working the auto population of this form: http://getpocket.com/save

I'm using it rather than the API so that it works when users are logged into Pocket on the same browser as my website.

However, it's not a good user experience to then have to click 'save', so how can I "automate" that?

I won't show my code, because it essentially is just to generate a link of the form:

http://getpocket.com/save/?title=thetitle&url=encodedurl

It populates the form fine, but how can I submit? I tried apending &save and &submitand then each of those =True, in vain. Is the issue that the save button doesn't have a name= field, which is what's used to hook into the title and URL fields?

EDIT: Just to be clear, I didn't have any malicious intentions, only to save articles to read later on click of a button.

If I find the time I'll have a look at the API.

OJFord
  • 10,522
  • 8
  • 64
  • 98

1 Answers1

2

Luckily this is impossible (on Pocket and most sites) due to cross site forgery request protection to prevent exactly what you are trying to do.

A token is set in the form and together with session information for the user on pocket (or any other site that uses csfr token protection) it will need to form some sort of secret hash. When the 'save' form is submitted the combination of these strings will be checked and normally new strings will be set. Because there is (practically) no chance that you will be able to predict the token form the form itself and have no real way of manipulating the session hash, you are out of luck. And we are all very happy for that :).

Otherwise you could make links on other sites that would delete your whole database when you happen to click on them, etc.

In short: You can't.

On any form without csrf protection you'd have to target not the url of the page with the form, but the 'action' of the form. You can see this action by inspecting the form with your browser's DOM inspector. But, as I said, csrf protection will prevent this from working most of the time.

http://en.wikipedia.org/wiki/Cross-site_request_forgery

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

Mosselman
  • 1,718
  • 15
  • 27