Mastodon Feed: Post

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

Let's try something a bit more impactful.

$user = $db->getUser(['username' => $request->username]);

$cookie = 'username=' . $request->username;

// put pw check here

if ($user->isAdmin()) {
   $cookie .= '&admin=1';
}

$cookieMac = hash_hmac('sha256', $hashInput, SECRET_KEY);
setcookie('login', $cookieMac . $cookie);

And let's assume there are no character restrictions on usernames during registration.

Can you see how to forge an &admin=1 cookie?