5 ms·
Authorization Bypass in Next.js Middleware
- deleted 2y ago[deleted]
- cjbprime 2y agoLooks like it was possible to include the `x-middleware-subrequest` header in your request, tricking the state machine into thinking you'd passed auth already. (Don't use the user input itself to encode state!)
- deleted 2y ago[deleted]
- theschmed 2y agoMore details here: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware https://zhero-web-sec.github.io/research-and-things/nextjs-a... Hat tip ash: https://news.ycombinator.com/item?id=43451485 https://news.ycombinator.com/item?id=43451485