Client POSTs creds, and if authenticated, server responds with a 302 redirect to an enormous path:


where encoded_data is either 811, or 726 characters long (for admins and unprivileged users respectively).

charset is [a-zA-z0-9_-] and looks like underscore/hyphen are being used to encode data rather than as separators. here are the first 80 characters from four authenticated requests:


Client GETs the massive path string and server responds with a new, PHPSESSID cookie value for the authenticated session. I realise length, and the /login/auth/ component of the path could be variable (user-set), but I don't know how it has been configured.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.