2026-09-20 17:30 UTC
Replies (3)
-
@rtificial@infosec.exchange 2026-09-20 22:17
@jik@federate.social @rk@mastodon.well.com I’ve seen this in various forms quite often. If you use a proxy tool like burpsuite you can usually step by step walk an app loading and see some wild stuff or just bypass it altogether. (Looking at you ArcGIS) But it usually some backwards flow of how auth is handled, where they SHOULD check first before loading and not checking midway or after loading a page or api.
-
@jik@federate.social 2026-09-20 17:31
It kind of feels like the people designing and building these systems need to go out of their way to get this wrong. I mean, can't they just put a timeout on the session cookie? Then when the user revisits the site, the cookie won't be sent, and they won't be treated as logged in? What are they doing instead? 2/2
-
@grumpybozo@toad.social 2026-09-21 01:56
@jik@federate.social I have seen that happen with sites that I know are not actually sending the initial screen; it is the browser restoring the page it saw last time, just in case they get a 304 and don’t need to reload everything. I have also seen it when the server actually does send a 304 on first contact and only notices the lack of authentication when the browser tries to load something new.