Timeline for SSL cookie without secure flag set situation for "Authorization: Bearer"
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 20, 2018 at 9:52 | vote | accept | Lucian Nitescu | ||
| Apr 19, 2018 at 19:20 | comment | added | AndrolGenhald | @LucianNitescu It's impossible for us to tell as it depends on the code making the requests, and whether or not you can get that code to make an unencrypted request. | |
| Apr 19, 2018 at 19:02 | answer | added | Peter Harmann | timeline score: 1 | |
| Apr 19, 2018 at 13:49 | comment | added | Lucian Nitescu | @eckes I do not care if it is or not, the question is about: Would I be able to do it, if I am able to retrieve PHPSessionID? | |
| Apr 19, 2018 at 1:22 | comment | added | eckes | There is no secure mechanism for Authorisation headers. You would have to check in the code which sets this header for the XHR. | |
| Apr 18, 2018 at 23:38 | comment | added | Lucian Nitescu | @AviD 401 Unauthorized. PHPSessionID is not an session cookie. | |
| Apr 18, 2018 at 22:35 | comment | added | AviD♦ |
How does the application respond if the cookie is present, without the Authorization: Bearer header?
|
|
| Apr 18, 2018 at 21:49 | comment | added | Lucian Nitescu | @AndrolGenhald For example: I can already redirect any user to use "example.com:443/api/v2/admins/me/account" and I can already intercept PHPSessionID but i wonder if I can also intercept "Authorization: Bearer". | |
| Apr 18, 2018 at 21:43 | comment | added | AndrolGenhald | It's generally much easier to trick users than code. How do you expect to get it to send an unencrypted request to the api? | |
| Apr 18, 2018 at 21:41 | history | asked | Lucian Nitescu | CC BY-SA 3.0 |