4 ms·
The changes are pretty ridiculous [1], apparently the gobernment's devs kept deliberately renaming a specific header by adding and increasing a number at the en
by snicksnak 6y ago
The changes are pretty ridiculous [1], apparently the gobernment's devs kept deliberately renaming a specific header by adding and increasing a number at the end, from `xsrf-token` up to `xsrf-token11` [0], clearly only with the intend to break their rival free market app.
[0] https://twitter.com/oppnaskolplatt/status/1375052301182906373 https://twitter.com/oppnaskolplatt/status/137505230118290637...
[1] https://github.com/kolplattformen/embedded-api/commit/b611228ab4785f8de0c39dfdf1fea78522226c1c#diff-49d517a3c6653cb9108c98a12d14e99f9a88bb5bcbff83a07a9347ef75cfed7dR166 https://github.com/kolplattformen/embedded-api/commit/b61122...
- ZephyrBlu 6y agoIt's hilarious that this is actually happening.
- current123123 6y agoHilarious and potentially illegal.
- yoelo 6y agoThe devs don't work for the Stockholm region nor the government. They are contractors. Stockholm is notorious for terrible fragmented outsourcing programs
- mwidell 6y agoMaybe Öppna Skolplattformen should just change their code to identify the token by its contents, no matter the parameter name?
- enedil 6y agoGood luck with that if it's a CSRF token.
- osirisguitar 6y agoIt's supposed to be :-D
- urvader 6y agoWe did. We have a regex to catch all variants of spellings. But since our code is open they can easily select another variant. We could load our script dynamically but have chosen not to of security reasons. (And transparency). (I’m the founder of this initiative)
- RupertEisenhart 6y agoCan't you ban the malicious Devs? They keep creating new GitHub accounts or what?
- toyg 6y agoNot OP but from what I understand, the problem is that their code has to interoperate with the “private” service run by the “bad guys”; it’s basically a more usable front-end. So the bad guys keep messing with the backend just to break the open client.
- dromtrund 6y agoI assume they read the code that tries to parse the data, and come up with formats that don't fit. If the code is open, they don't need accounts to see it
- developer92 6y agothey need one to contribute changes though
- bitterblotter 6y agoThey should just fuzzy match the headers!! Just kidding. This is ridiculous
- ric2b 6y agoThey are now, look at the linked commit.