Xtrendence / X-Notes

X:/Notes is a note taking web app developed in HTML, CSS and JavaScript (+jQuery) for the front-end, and PHP for the back-end. Notes can be encrypted with AES-256.
https://www.xtrendence.dev/pages/x-notes/
18 stars 8 forks source link

"Remember Me" feature is insecure. #1

Closed Xtrendence closed 5 years ago

Xtrendence commented 5 years ago

There is currently a security issue that will be fixed in an update shortly. The security issue is local only though. When a user logs in using the "Remember Me" feature, their username and password is stored in a cookie. It might as well be plain text since it's base64 encoded. I'll be changing this to a unique token system that will expire every week. So if you use the website on a computer that's used by other people, don't use the remember me feature and remember to delete the password cookie if you do test it out.