3 ms·
So ... some third-party services implicitly trust the auth data their own apps send them, without verifying the auth data with Facebook/Google/etc. servers from
by pritambaral 10y ago
So ... some third-party services implicitly trust the auth data their own apps send them, without verifying the auth data with Facebook/Google/etc. servers from their server-side code.
TL;DR: Some services forgot the "never trust client-sent data!" rule.
- mSparks 10y agoI dont think they forgot it. Just never something they considered. "My app is to small and insignificant and not doing anything of much importance to be targeted by a nation state so I don't need to care about security" That pervades the developer scene. Blended with a spice of nothing to hide nothing to fear.