5 ms·
AMC Order Confirmation Pages Are Indexed by Google, Exposing Sensitive Info
- deleted 4y ago[deleted]
- Shadonototra 4y agoShady af, that probably mean some people have access to that data aswel if it is all in clear
- frankhhhhhhhhh 4y agoDelivery fee for food ordered inside the theater!
- LeftHandPath 4y agoAnd I never would've found the bug if I didn't look it up to check if I understood the fee right!
- adamomada 4y agoThis has to be because Chrome browser is submitting every URL you visit to google and then google running a crawler immediately, right? Or has chrome browser become the crawler ?
- LeftHandPath 4y agoThat could make sense. The pages don't always seem to be crawled
- usrn 4y agoSeeing the last four credit card digits in some of the results makes me think the browser is actually submitting the page content.
- kgbcia 4y agosession token/cookie should expire to prevent user info from being viewable, whether or not google indexes it.
- 8note 4y agoIf google caches it quickly, it'd be viewable for a long time after the tokens have expired?
- Nextgrid 4y agoNo - the session cookie is private to the browser that originally placed the order, so the Google crawler should get a 403 as it doesn't have that cookie.
- LeftHandPath 4y agoSome of the pages load and show full details even when you open them in an incognito window. Really hoping for a reply from AMC but I don't expect one. I also wondered if they might be test pages of some sort but they look legitimate.