Security issue with confirmation token

laracasts / Lets-Build-a-Forum-in-Laravel

http://laracasts.com/series/lets-build-a-forum-with-laravel

915 stars 309 forks source link

Security issue with confirmation token #36

Open flamisz opened 7 years ago

flamisz commented 7 years ago

As we put the Auth::user() into the head section, the user can see the confirmation_token. He can fake the confirmation by hitting the proper route with this param.

The confirmation_token should be a hidden attribute in User model.