First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

Re:First American Financial Corp. Leaked Hundreds of Million... by scarface74 on Friday May 24, 2019 @09:38PM (#20006610)

If the cookie is spoofed and someone got another clients authorization token, then they would get any documents that user was authorized to see anyway.

But you don’t do cookie.userid.

You send the username and password to an authentication service which generates a token with a checksum. The token along with the username and permission is cached in something like Redis.

On each request, middleware gets the user information back using the token.

[ Parent | on HN ]

Re:First American Financial Corp. Leaked Hundreds of Million... by pointytrees on Sunday May 26, 2019 @09:35PM (#20018812)

I'm familiar with that process. I was trying to illustrate a picture of how a poor developer might stumble their way into this situation. It's technically possible to store the userid in the cookie rather than using JWTs, but obviously it's not secure in the slightest.

[ Parent | on HN ]