4 ms·
I would consider it a “moderate” or “low” severity issue, the same as “session cookie does not expire.” Authentication tokens intended for ephemeral browser se
by infotogivenm 4y ago
I would consider it a “moderate” or “low” severity issue, the same as “session cookie does not expire.”
Authentication tokens intended for ephemeral browser sessions should expire, it’s good practice not to hand out infinite-access credentials.
- ruskyhacker 4y agoI sort of explained my thought process above but I suspect they've done it this way for "cdn things" It's not great, there's certainly a way to secure it, but like many other solutions - stuff it in a storage bucket with a "random" url is "good enough" in the eyes of the platform.
- infotogivenm 4y agoNo disagreement here, that must be why they do it. But most CDNs e.g. S3 handle expiry in their signed URL implementations.