4 ms·
Attacking Web Applications with Broken Authentication
- bscofield 18y agoWait, so this guy is recommending against storing predictable user IDs in cookies, and against pre-filling password fields such that the values can be read in the source for a page? Brilliant! /facepalm
- enablesecurity 18y agoDon't think so. I'm just showing you how to abuse that without doing much ;) Seen such behavior on both local ISPs and an Information Security conference website. Its one of those things that should not be there but every now and then some webdev decides to include ;)