6 ms·
Oops your developer accidentally enabled logging for headers. Now everyone with access to your logs can take over your customer accounts.
by peanut-walrus 1y ago
Oops your developer accidentally enabled logging for headers. Now everyone with access to your logs can take over your customer accounts.
- londons_explore 1y agoYou could have similar secure handling of cookies on your server. For example, the server could verify the cookie and replace it with some marker like 'verified cookie of user ID=123', and then the whole application software doesn't have access to the actual cookie contents. This replacement could be at any level - maybe in the web server, maybe in a trusted frontend loadbalancer (who holds the tls keys), etc.