codeforamerica / bizfriendly-web

An experiment in digital literacy lessons. The experiment is now over.
http://bizfriend.ly
22 stars 67 forks source link

Cookie manipulation can fake appearance of being logged in #67

Open ondrae opened 11 years ago

ondrae commented 11 years ago

Description

If a person changes their cookie to signedIn = true, then our site will give them the appearance of being logged in. The aren't really logged into our backend though, so they can't interact with the lessons.

A possible fix would be to have log in validation with the back end happen on every page load.