Tag
1 piece on this topic.
A shopping API let any signed-in user read any order just by changing a number in the URL. The server checked that you were logged in, but never that the order…
← All tags Write-ups