3 ms·
How could that possibly, ever have made it through. Every single API for every single service didn't check the JWT?
by mjfisher 4mo ago
How could that possibly, ever have made it through. Every single API for every single service didn't check the JWT?
- maciekkmrk 4mo agoIt started as internal service where you need to be connected with a VPN so why bother with security.
- Ekaros 4mo agoVibe coding? Just have LLM make it and then press merge?
- himata4113 4mo agoEh, ironically this is an easy mistake to make for a human especially around how middleware is handled in express or other nodejs libraries, it's the reason why so so many of the vulnerabilities come from node based apps. Python has similar footguns as well with undefined objects failing open. Typescript has somewhat mitigated these for node, but there is no real fix for python other than skipping libraries that allow failing open.
- BobDaHacker 4mo agoYeah I see this type of crap often honestly, especially at big companies.