3 ms·
The RefreshAt is a week, but if the code is actually valid for a week, it's not clear why a simple screenshot of the code didn't work.
by wrs 1y ago
The RefreshAt is a week, but if the code is actually valid for a week, it's not clear why a simple screenshot of the code didn't work.
- xeromal 1y agoI don't know security that well but if the puregym app refreshes the token then the old tokens would expire immediately right?
- shermantanktop 1y agoNope. As I read it, any token less than a week old would work. So for any user, they have 7 * 24 * 60 tokens live at any time.
- dwedge 1y agoHe said the code from Monday didn't work on Tuesday
- valzevul 1y agoYeah, screenshot on Monday, messed with the app that evening, tried using it Tuesday morning -- dead. I've seen people on PureGym's Twitter successfully refreshing screenshots weekly though, and the API response suggests the same. That being said, I couldn't find a validation endpoint to check if mine got invalidated by something specific (maybe signing out?) or if there's some other magic happening.
- dwedge 1y agoI wonder if opening the app invalidated it, and those people who had it working just screenshot once. My gym has a similar system but I realised it's time based and the app functions without Internet. I installed the app onto an old android with no sim, logged in at home over WiFi and it successfully regenerated QRs without data
- wahnfrieden 1y agono
- bpicolo 1y agoIt seems like it did work and they didn't want to deal with manually updating it weekly
- MBCook 1y agoBecause you’d have to waste the time to take a new screenshot every week, of course.
- aembleton 1y agoProbably invalidates old tokens when a new one is generated.