from Hacker News

A bizarre “403 Forbidden” bug-hunting adventure

by joshsharp on 9/27/17, 5:00 AM with 42 comments

  • by luketheobscure on 9/27/17, 7:15 AM

    "NSURLSession oh so helpfully auto-fucking-matically decided I would probably—no, definitely—want to send those cookies in every single request my app did after that. Forever and always."

    I imagine it honors the "expires" property of cookies, it just probably wasn't set. Also there's an "ephemeralSessionConfiguration" you can use if you don't want to store the cookies. I enjoyed the article, up until the author blamed the framework for their own ignorance.

  • by js2 on 9/27/17, 2:42 PM

    Oh hey, I know this. From a commit message earlier this year for an SDK I own:

    SDKSender: switch to ephemeral NSURLSession and disable cookie storage

    Switch to a private (ephemeral) session independent of the app and disables cookies. The SDK otherwise shares the cookie storage with the app, which is not desired. This was causing the SDK to send the $dayjob tracking cookie (and others) to $dayjob API endpoint.

  • by udioron on 9/27/17, 7:26 AM

    Another fix is to disable CSRF checks for all API calls which should not be served by a browser (assuming they use a different auth mechanism which does not involve cookies!). This makes sense since CSRF is a layer that relates to attacks involving browsers/cookie authentication.
  • by Grollicus on 9/27/17, 1:52 PM

    Despite using Functions he doesn't really understand and yada yada i think this is a good reason to have a dedicated api endpoint and not mix it with domains where the normal web access happens.
  • by exikyut on 9/27/17, 6:25 AM

    This is both awesome and depressing.

    But it gave me a really interesting idea: a service/network/community/forum/etc for people to gather and discuss Really Confusing Bugs™ that they're trying to figure out. Not necessarily (?) for contemporary end users (maybe highly technical end users).

    This could actually be a really cool concept. Somewhere squarely between HackerOne and StackOverflow - not for exploits, and not for simple(r) stuff, but specifically for complicated and confusing bugs you've been staring at for days/weeks and nothing's making any sense.

    I can see a subscription model working for this, even - subscriptions would work both to allow people to provide extended assistance, and also because a contract makes NDAs easier.

    Hmm. Thinking about how the subscription model would work... you sign up, configure billing, that then allows you to request extended assistance.

    - One way that could work is that people offer you help in return for thanks, which would work like a configurable upvote; higher quality answers attract more rewards. Maybe anyone can reward answers (via the credit in their account) after the fact?

    - Another way would be setting a minimum or exact reward amount up front to attract more help.

    Regardless of how it worked, the site would have all discussion be public and open by default; you'd have to check a box to make the discussion private, and even after that you'd have the ability to go through and selectively un-redact parts of the conversations so everyone could be helped.

    And anyone could sign up and offer answers instantly, and the rewards credited to their account could be cashed out at any time. That would attract new users.

    I realize I've just described a weird kind of paid StackOverflow. I am very curious why SE hasn't pursued such an idea. As in, I am 1000% confident they've had this conversation at least once, and I'd really love to hear what the opinions were.

  • by catshirt on 9/27/17, 2:34 PM

    when you have a bizarre request issue... find a working request, find the failing request, compare the headers... problem solved.
  • by stanleydrew on 9/27/17, 7:17 AM

    Not sure about the "fix", since now users can't persist a logged in browser session?

    If you aren't using cookies for API auth, is there not some way to configure your server framework to just ignore them if received?

  • by CodeWriter23 on 9/28/17, 4:59 AM

    Just popped in to say Wireshark would have made short work of this bug.
  • by foota on 9/27/17, 7:03 AM

    Are they using a header or s.t. for their authorization in app, then?
  • by oretoz on 9/27/17, 3:29 PM

    Za