search

fantastic-five / project

Our group's main project for CS 361.
0 stars 4 forks source link

Login System is Insecure #14

Open Ajedi32 opened 11 years ago

Ajedi32 commented 11 years ago

Our current login system works by setting a cookie containing nothing but the logged in user's username in plain text. Anyone who wanted to could easily change the username in that cookie to anything they wanted, thereby logging themselves in as any user they want to without needing to enter a password.

Ajedi32 commented 10 years ago

Not to mention that we store passwords in the database in plaintext.