Vanilla open source was terminated 1 January 2025 by Higher Logic. See this announcement for more information.

Security Bug - Cookie Authentication

Entriple · 2006-06-05 13:31:52

I just found a considerably large Security issue with the Cookie Authentication used in Vanilla, so I thought it would be nice of me to share it. The current mechanism in place to keep Sessions persistant via Cookies uses the following code: $EncryptedUserID = ForceIncomingCookieString("pass", ""); $VerificationKey =…

Comments

lech ✭

June 2006

Lies! END HIM!

0

This discussion has been closed.