We are integrating into a system and I have some concerns over the security. As a test, I have taken a bearer token that was issued in a request 2 months ago and managed to perform a successful, authenticated request to the test system.

The live system blocks requests using older tokens, which is good. However, it suggests that the live system has the potential to be either storing older tokens or the potential (with maybe an unintentional change) to accept older tokens.

I'm quite concerned that the test system would be developed in a way that allows reuse of tokens. Should this be a concern and what are the potential implications?

Thanks in advance

Update: We have now found that some tokens are reusable on the live system as well.

  • I don't think this can really be answered without looking through the source. Your best bet is to talk to the development team – Conor Mancone Jan 13 at 23:31
  • Thanks Conor. Do you mean that it is not necessarily a security issue to be able to reuse tokens? Also, we have now found some tokens can be reused in the live system too. – thebronsonite Jan 14 at 10:56
  • No. Sometimes this just seems like one of those cases where the actual implementation matters, and only your development team knows what that looks like. To pick an example, we do turn off some security checks in our testing system because it makes it much easier to test. Does that make it more likely to skip a check in production? Not really, but sometimes stuff like that is necessary anyway. Whether or not this might be a security vulnerability depends on a number of things, and there just isn't enough data here to know for sure. – Conor Mancone Jan 14 at 15:12
  • For example, you talk about reusing bearer tokens, but what is a bearer token? Is it a session id? Because if so it might very well be good for 2 months. Is it a JWT with a short expiration? In that case using it two months later implies that the expiration isn't being properly checked, which is a problem. There are just too many variables here. – Conor Mancone Jan 14 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.