What is a security token and why is it used in forms?

Question

I have seen in many forums and other sites that they use a security token (a long string) in their POST or GET method. For example (POST Method):

<input
    type="hidden"
    name="securitytoken"
    value="1363774829-89afb5d0fbcd2f8d55db0b675061d62bd21ca94e"
/>

GET method example:

http://www.example.com?attribute=xyz&token=f0ec0e8e1622a030cbc543d3ac42729e

What is this security token? And why is it used? What type of security does it provide? Where should it be used?

Answer 1

It is probably a token to prevent "CSRF" (Cross Site Request Forgery).

For example,

• you are logged in to the forum
• you go to evilhacker.com
• evilhacker has an auto-submitting form that sends spam to the forum
• because you are logged in, you post (in your name) the spam.

But because the forum needs some token that is tied to your session (so evilhacker cannot guess it for his own form), the post is rejected and you did not post spam.

If you want to see some details, read this paper