Since i write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak...

1. When I login, I send POST request containing the login form, but my login cookie is plain text saved ( maybe insecurly deserialized ) -> a:2:{i:0;s:8:"username";i:1;s:8:"password";}

2. After successful login, the website start the session  : it define some varible/functions, its the first thing it does for any user loading. One of these variables is a random 40 string characters, used to validate user requests during the session. This string changes each time the session is loaded.

3. This website use AJAX to format POST request. They are sent unencrypted, its possible to intercept, edit, then send request without problems. Typical POST request looks like  :

I edited the request to remove every useless elements, in fact this POST can be accepted by the server if I fill bracket with right data.

Real request body to illustrate what kind of data i send (copy pasted from wireshark) :

Result : JavaScript pop-up saying im connected from somewhere else 

Result : Empty Response 

Result : JavaScript pop-up saying im connected from somewhere else BUT IN ATNOTHER LANGUAGE 

-----------------------------------------------------------------------------

Is there a risk that a malicious crafted request, in any way, can bypass the key argument and control accounts arbitrarily ? Especially knowing that PHP array() (and maybe serialize()) function are used...

-----------------------------------------------------------------------------

Thank you in advance for your answers

Since I write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak...

1. When I login, I send POST request containing the login form, but my login cookie is plain text saved ( maybe insecurly deserialized ) -> a:2:{i:0;s:8:"username";i:1;s:8:"password";}

2. After successful login, the website starts the session: it defines some variable/functions, it's the first thing it does for any user loading. One of these variables is a random 40 string characters, used to validate user requests during the session. This string changes each time the session is loaded.

3. This website uses AJAX to format POST request. They are sent unencrypted, it's possible to intercept, edit, then send requests without problems. Typical POST request looks like:

I edited the request to remove every useless elements, in fact this POST can be accepted by the server if I fill bracket with the right data.

Real request body to illustrate what kind of data I send (copy/pasted from wireshark) :

Result: JavaScript pop-up saying I'm connected from somewhere else 

Result: Empty Response 

Result: JavaScript pop-up saying I'm connected from somewhere else BUT IN ANOTHER LANGUAGE 

Is there a risk that a maliciously crafted request, in any way, can bypass the key argument and control accounts arbitrarily? Especially knowing that PHP array() (and maybe serialize()) function are used...