Reset Password Token Invalidated On HTTP GET #1

New Issue

2021-01-08T01:07:09-06:00

glm94 commented

2021-01-08 01:07:09 -06:00

The reset password token gets some characters stripped from it when it's sent as a URL parameter. For instance a token like this:
"a/+m4AMhSo6kfRh8K7PFFt3VrKNUfLcYfjDCrdWiXvjbATbeiCHCe0lvqOXYBb7tZTad4YYh4A3PhDDoPapnjQ==" becomes this:
"a/m4AMhSo6kfRh8K7PFFt3VrKNUfLcYfjDCrdWiXvjbATbeiCHCe0lvqOXYBb7tZTad4YYh4A3PhDDoPapnjQ==". The plus sign is stripped from the token invalidating it before the C# code can even check its validity.

The reset password token gets some characters stripped from it when it's sent as a URL parameter. For instance a token like this: "a/+m4AMhSo6kfRh8K7PFFt3VrKNUfLcYfjDCrdWiXvjbATbeiCHCe0lvqOXYBb7tZTad4YYh4A3PhDDoPapnjQ==" becomes this: "a/m4AMhSo6kfRh8K7PFFt3VrKNUfLcYfjDCrdWiXvjbATbeiCHCe0lvqOXYBb7tZTad4YYh4A3PhDDoPapnjQ==". The plus sign is stripped from the token invalidating it before the C# code can even check its validity.

glm94 added the bug label 2021-01-08 01:07:09 -06:00

glm94 commented

2021-01-08 10:53:55 -06:00

Fixed in commit c2297ed368. The reset token needed to be URL encoded before it could be used in a URL. Seems I failed to realize converting a string to base64 doesn't make it URL safe.

Fixed in commit c2297ed36825fe72c8650664e19976e494318f77. The reset token needed to be URL encoded before it could be used in a URL. Seems I failed to realize converting a string to base64 doesn't make it URL safe.

glm94 closed this issue

2021-01-08 10:53:58 -06:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: glm94/secure-core#1