Issue with remember_user_token
Unknown
Vulnerability Details
When a user logs out, cookie named remember_user_token is invalidated on the user side. When the user log in again with functionality 'remember me for a week', he gets the same value of remember_user_token as previously.
Moreover, when there is only cookie named remember_user_token in request, the user gets the same value of remember_user_token in forthcoming response.
As it can be seen in the aforementioned cases, remember_user_token is not regenerated, what constitutes a weakness in lifecycle of this cookie.
Actions
View on HackerOneReport Stats
- Report ID: 7931
- State: Closed
- Substate: resolved
- Upvotes: 4