3 ms·
> There was no authentication at all on the email there. I did report that, hopefully they fixed it fast. I bet there was some token in the URL, and that URL w
by RcouF1uZ4gsC 7y ago
> There was no authentication at all on the email there. I did report that, hopefully they fixed it fast.
I bet there was some token in the URL, and that URL with the token was sent as the referer, and then when you clicked the link, you also got the authentication token since it was in the URL.
- exikyut 7y agoOk that was a small beer-bottle-over-the-head moment. Does this sort of disaster have a specific name? I realize it's a type of XSRF but I don't know of any contractions for "I was erroneously supplied working credentials and this needs fixing". This reminds me of the practice of digging through GitHub for leaked credentials.