To the Admins: Possible Security Related Bug in discussions.apple.com Login

Question

Level 1

130 points

To the Admins: Possible Security Related Bug in discussions.apple.com Login

To the discussion/support site admins. There seems to be a security flaw in the Login of discussions.apple.com. If you logout and then you press login again, it automatically logs you in without entering any password or username. This could mean if you stopped using your computer but you're still on the discussion page and the next user clicked login, the person will be able to log in your account without entering any password or username. The only way to prevent that is to quit Safari (I'm not sure if it's the same with other browsers).

Please fix as soon as you can. Thank you.

Gbu.

iMac i7 Late 2009, Mac OS X (10.6.6)

Posted on Feb 25, 2011 6:45 AM

Reply

Answer 1

Beavis2084

Level 4

2,854 points

Feb 25, 2011 8:48 AM in response to Alvin777

Make a note... apple doesn't monitor this forum.

Proper bug reporting should me made here:

https://bugreport.apple.com/cgi-bin/WebObjects/RadarWeb.woa/wa/signIn

And i have not had that issue as you outline.

Reply

Answer 2

Tuttle

Level 7

29,565 points

Feb 25, 2011 9:14 AM in response to Alvin777

Proper place to ask this question is the Discussions Feedback forum:

http://discussions.apple.com/forum.jspa?forumID=1076

Session cookies are in use here. They are active from the time you log in until you close (quit) your browser. (Anomalies have been reported in some versions of some browsers where members are asked to log in multiple times without quitting their browsers.)

If you want to log out completely and securely without quitting your browser, then you should delete Apple Discussions-related cookies.

Reply

Answer 3

Alvin777 Author

Level 1

130 points

Feb 25, 2011 3:36 PM in response to Alvin777

Reposted to the proper forum. Thank you for the heads-up.

Reply

Answer 4

Barney-15E

Level 10

123,020 points

Feb 25, 2011 3:41 PM in response to Alvin777

I can't replicate that.
Are you sure the username and password weren't autofilled. Perhaps you clicked before it appeared to fill in, but it did.

Reply

Answer 5

Alvin777 Author

Level 1

130 points

Feb 25, 2011 4:07 PM in response to Barney-15E

Hi. I just logged in without any password or screename again just now (just by clicking login even though I just logged out awhile ago). I always uncheck saving passwords or auto login though I haven't seen any save passwords or auto login at the login page. Where can I check if auto login or save password is checked? Thanks.

Reply

Answer 6

Barney-15E

Level 10

123,020 points

Feb 25, 2011 4:16 PM in response to Alvin777

There isn't anything in the forum settings. I was just talking about Auto-Fill in Safari.

Can you explain the exact steps?
Which browser? version?

Reply

Answer 7

Alvin777 Author

Level 1

130 points

Feb 25, 2011 4:31 PM in response to Barney-15E

I unchecked everything in the Autofill in Safari but it's still the same. I'm using 5.0.3.

Steps: Login, stay on the page where the categories are listed (the page just after logging in) then Logout then click Login again, it'll login without entering any password or screename. If you clicked a category and you're not on the main and then you logged out, sometimes the bug doesn't happen it seems.

Reply

Answer 8

Barney-15E

Level 10

123,020 points

Feb 25, 2011 4:39 PM in response to Alvin777

I still can't replicate it. I'm not sure what else to look for.

Reply

Answer 9

baltwo

Level 9

62,386 points

Feb 25, 2011 4:40 PM in response to Alvin777

I suspect, since the page is cached and you can select Safari->History->Reopen Last Closed Page, that there's persistence. If that's correct, then logout, empty the cache, and try logging back in. If it still occurs, then the login info might be stored on the Server for some amount of time before it's deleted. If that's the case, quit Safari or change categories.

Reply

Answer 10

TildeBee

Level 7

31,923 points

Feb 25, 2011 6:06 PM in response to Alvin777

Alvin --
Are sure you are actually logging out, or are you just clicking the red button to close the page?
Because an official "Logout" does just that. It logs you out.
You are actually clicking on "Logout" just under the "Welcome, Alvin777" line to the right?

Reply

Answer 11

Feb 25, 2011 6:30 PM in response to baltwo

I have noticed this with Firefox. I log out of Discussions, go off to other pages, then decide to go back to Discussions. If I click on login at the right side of the main window, it will log me in without going to the ID-password page. Never thought of it as a problem. It only happens when a short period of time - a few minutes - has passed between log out and log back in. And not every time.

I would go with your temporary server cache suggestion. I don't remember this ever happening on another site, regardless of the time between logout and log back in -- even less than a minute.

Reply

Answer 12

baltwo

Level 9

62,386 points

Feb 25, 2011 6:52 PM in response to Peter Bannon

Reply

Answer 13

Alvin777 Author

Level 1

130 points

Feb 25, 2011 8:10 PM in response to TildeBee

Hi. I always click the Logout at the bottom of Welcome.

Reply

Answer 14

Barney-15E

Level 10

123,020 points

Feb 26, 2011 1:27 PM in response to Alvin777

Well now you've done it. I can't stay logged in anymore. I went for a while when I always had to log in whenever I left the AD page. Then, it was back to normal. Now, after logging out a couple of times, I seem to get logged out frequently, now.

We need to swap accounts. You can't stay logged out and I can't stay logged in.

Reply