search

floatplane / MitsuQTT

Use ESP8266/ESP32 hardware to control Mitsubishi heat pumps via MQTT
GNU Lesser General Public License v2.1
3 stars 2 forks source link

`is_authenticated` is very dumb, doesn't even check the password #59

Open floatplane opened 4 months ago

floatplane commented 4 months ago

Just set a cookie to M2MSESSIONID=1 and you're in 🙄

https://github.com/floatplane/mitsubishi2MQTT/blob/41f5cfd9b22088fa098c1f014593f8ea38104f0d/src/main.cpp#L1962-L1972

floatplane commented 4 months ago

A reasonable improvement is probably to concatenate the remote IP address and the password, hash that and store it in the cookie. Then you can verify that the cookie seems valid for each request.

I don't think we need weapons grade security here.