4 ms·
Client side logout with seemingly no token expiration is a very serious vulnerability, especially for something like Uber where payments are involved.
by reificator 9y ago
Client side logout with seemingly no token expiration is a very serious vulnerability, especially for something like Uber where payments are involved.
- GregoryVPerry 9y agoYeah that's a big one, and an issue with the core of their entire authentication workflow that they cannot fix without invalidating tens of millions of apps or forcing everyone to upgrade. Whenever you sign off of their mobile app there is no communication with the network, they are just erasing the token on the client side.
- sushid 9y agoNot the parent commenter and I get what you mean, but if they state that it's a duplicate issue (and assuming on good faith that it is), doesn't it make sense that they don't pay you out for that? I'm 100% on your side regarding the XSS issue but you can't expect them to have a list of security vulnerabilities that they've already discovered at your disposal.
- chris_wot 9y agoYeah, but we have no idea how long this has been unfixed. I reckon all security bugs not paid out to Uber at this point should just get automatically publicly documented. Also: this is Uber. At this point, they’ve used up all their good faith. I definitely wouldn’t be taking anything they say in good faith - I still haven’t forgotten them threatening a journalist or publicly tracking the ride of a CEO for an entire room of people!
- deleted 9y ago[deleted]
- user5994461 9y agoI recall that either OAuth or SAML doesn't have capabilities for logout.
- mdaniel 9y agoI believe it's OAuth (same with JWT) in that there is no endpoint one can POST to in order to "logout," but the end-of-authorization concept exists in both OAuth and JWT via token revocation on the server-side SAML has an actual logout endpoint