Issue with remember_user_token

Disclosed: 2015-05-28 04:48:47 By dawidczagan To security
Unknown
Vulnerability Details
When a user logs out, cookie named remember_user_token is invalidated on the user side. When the user log in again with functionality 'remember me for a week', he gets the same value of remember_user_token as previously. Moreover, when there is only cookie named remember_user_token in request, the user gets the same value of remember_user_token in forthcoming response. As it can be seen in the aforementioned cases, remember_user_token is not regenerated, what constitutes a weakness in lifecycle of this cookie.
Actions
View on HackerOne
Report Stats
  • Report ID: 7931
  • State: Closed
  • Substate: resolved
  • Upvotes: 4
Share this report