News for hackers. Stuff that matters.

A comment on Klarna users are being signed in to random accounts. Parent comment

Re:Klarna users are being signed in to random accounts by iratewizard on Thursday May 27, 2021 @10:59AM (#27303919)
To get around this, one could include the request IP address in the JWT and required a refresh token to be sent when the user's IP switches.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by secureleaf on Thursday May 27, 2021 @11:07AM (#27304007)
This is not a safe method for protecting against this type of cache vulnerability. IP addresses are regularly shared by multiple users, especially when behind NAT (even mobile ISPs are doing carrier grade NAT these days).
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by iratewizard on Thursday May 27, 2021 @04:15PM (#27307762)
So there should be no fail safe since it can't be guaranteed to work in every scenario.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by remram on Thursday May 27, 2021 @12:26PM (#27304896)
In this context, this would just prevent everybody from logging in. The JWT would correctly get rejected but people would still be getting the wrong token from the CDN over and over.
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by iratewizard on Thursday May 27, 2021 @04:16PM (#27307787)
Which would you rather? The situation you just described or users accidentally spoofing each other's session?
[ Parent | on HN ]