4 ms·
Fun stuff. Serious question though: if you know the cookie signing key, can't you just mint yourself an admin session? Is the YAML vuln required to exploit this
by _forestfortrees 10y ago
Fun stuff. Serious question though: if you know the cookie signing key, can't you just mint yourself an admin session? Is the YAML vuln required to exploit this issue?
- spydum 10y agoI suspect no: you can sign cookies, but hopefully cookie only carries a session identifier. You'd still need to obtain a valid admin session..