A bizarre “403 Forbidden” bug-hunting adventure(blog.hellocode.co) |
A bizarre “403 Forbidden” bug-hunting adventure(blog.hellocode.co) |
I imagine it honors the "expires" property of cookies, it just probably wasn't set. Also there's an "ephemeralSessionConfiguration" you can use if you don't want to store the cookies. I enjoyed the article, up until the author blamed the framework for their own ignorance.
SDKSender: switch to ephemeral NSURLSession and disable cookie storage
Switch to a private (ephemeral) session independent of the app and disables cookies. The SDK otherwise shares the cookie storage with the app, which is not desired. This was causing the SDK to send the $dayjob tracking cookie (and others) to $dayjob API endpoint.
But it gave me a really interesting idea: a service/network/community/forum/etc for people to gather and discuss Really Confusing Bugs™ that they're trying to figure out. Not necessarily (?) for contemporary end users (maybe highly technical end users).
This could actually be a really cool concept. Somewhere squarely between HackerOne and StackOverflow - not for exploits, and not for simple(r) stuff, but specifically for complicated and confusing bugs you've been staring at for days/weeks and nothing's making any sense.
I can see a subscription model working for this, even - subscriptions would work both to allow people to provide extended assistance, and also because a contract makes NDAs easier.
Hmm. Thinking about how the subscription model would work... you sign up, configure billing, that then allows you to request extended assistance.
- One way that could work is that people offer you help in return for thanks, which would work like a configurable upvote; higher quality answers attract more rewards. Maybe anyone can reward answers (via the credit in their account) after the fact?
- Another way would be setting a minimum or exact reward amount up front to attract more help.
Regardless of how it worked, the site would have all discussion be public and open by default; you'd have to check a box to make the discussion private, and even after that you'd have the ability to go through and selectively un-redact parts of the conversations so everyone could be helped.
And anyone could sign up and offer answers instantly, and the rewards credited to their account could be cashed out at any time. That would attract new users.
I realize I've just described a weird kind of paid StackOverflow. I am very curious why SE hasn't pursued such an idea. As in, I am 1000% confident they've had this conversation at least once, and I'd really love to hear what the opinions were.
"Josh realised my app might be somehow getting cookies from visiting our site inside this web view, and then sharing those cookies with AFNetworking's underlying NSURLSession, which is handling my requests."
which would have been clear if they'd checked the cookies of the NSURLSession request.
then, in paragraph 17, the author starts concluding:
> "And so the the CSRF check was failing every time, because I wasn't sending a Referer header, or any other related CSRF bits."
which would have been clear if they tried comparing a working request to a failing request.
and finally,
> "And of course, I didn't even know about these cookies, so I wasn't deleting them on log out"
which leads me believe the author never checked the request at all, let alone before anything else.
i'm ignoring the fact the bug sat for months, and took a second person to fix, and got a write up on the blog... so i'm going to have to assume my advice has an audience (like anyone who would classify this bug as "bizarre").
(not trying to pass judgement on the author here at all... we have all been there :))
If you aren't using cookies for API auth, is there not some way to configure your server framework to just ignore them if received?
We are using cookies, as the post says, as a fallback authentication so devs can browse the API from a browser if they're logged in to the site.
[1] They still exist, and it apparently gets traffic/use, but never hear anyone talking about them, and it never comes up when searching to resolve or diagnose a problem.
I remember getting screwed over but don't remember the details: they locked up the site and I couldn't even access the solutions I'd written anymore. A bit later still they made it appear locked but you could still get to the answers if you knew how (I think that was to get their solutions on Google.
I'd guess it was taken over and someone tried to squeeze the money out, hasn't happened to SO yet.
Should be universally open to all - at least until someone screws up badly enough to get temporarily or permanently barred, needs to be open outside regular work hours, should be free (or super a inexpensive nominal charge) to enter, would need to monetise itself via other means, perhaps selling beverages.
We've just re-invented "the bar"... ;-)
* The question is closed as a duplicate, but the question it's a duplicate of is subtly different enough to be completely irrelevant to me.
* The question is closed as a dupilcate, but there's no link to what it's a duplicate of.
* The question is closed as a duplicate, but there are no good answers to the question it's a duplicate of.
At some point, the whole of SO shifted, and what you had was a bunch of point-chasing, terrible "programmers" gaming the system for points. There are actually a substantial number of reasonable questions which are not even slightly related to the questions they're closed as duplicates of. But in the eyes of these shit-awful "programmers" they're similar enough to close. Stack Overflow is on its way out. It has served its purpose in life, and perhaps will remain somewhat relevant to the kinds of enormous enterprises that hire shit-awful programmers with their Stack Overflow points on their resumes. But all the reasons it was originally attractive are now gone, as are the majority of the excellent programmers that made it interesting.
I'm not sure if Quora is its replacement, and I'm not sure what the next big place where excellent programmers go to share insights looks like. But it's not Stack Overflow.
I'd be surprised if AFNetworking didn't also offer the ability to create a "private" NSURLSession with custom storage objects.
I'd also recommend looking into debugging these types of issues using, eg, Charles Proxy. There's more information on logging at:
https://developer.apple.com/library/content/qa/qa1887/_index...
See also:
https://developer.apple.com/videos/play/wwdc2013/705/
Disclaimer: NSURLSession contributor...