2026-07-10 15:35 UTC
Let's try something a bit more impactful.
$user = $db->getUser(['username' => $request->username]);
$cookie = 'username=' . $request->username;
// put pw check here
if ($user->isAdmin()) {
$cookie .= '&admin=1';
}
$cookieMac = hash_hmac('sha256', $hashInput, SECRET_KEY);
setcookie('login', $cookieMac . $cookie);
And let's assume there are no character restrictions on usernames during registration.
Can you see how to forge an &admin=1 cookie?
Replies (1)
-
@soatok@furry.engineer 2026-07-10 15:37
Whenever you hear about "domain separation", this is basically the intuition you need. It isn't always this straightforward, of course.