Hacker News Reader

Comment by reificator | Hacker News Reader

Client side logout with seemingly no token expiration is a very serious vulnerability, especially for something like Uber where payments are involved.

View on HN

Yeah that's a big one, and an issue with the core of their entire authentication workflow that they cannot fix without invalidating tens of millions of apps or forcing everyone to upgrade. Whenever you sign off of their mobile app there is no communication with the network, they are just erasing the token on the client side.

Not the parent commenter and I get what you mean, but if they state that it's a duplicate issue (and assuming on good faith that it is), doesn't it make sense that they don't pay you out for that?

I'm 100% on your side regarding the XSS issue but you can't expect them to have a list of security vulnerabilities that they've already discovered at your disposal.

Yeah, but we have no idea how long this has been unfixed. I reckon all security bugs not paid out to Uber at this point should just get automatically publicly documented.

Also: this is Uber. At this point, they’ve used up all their good faith. I definitely wouldn’t be taking anything they say in good faith - I still haven’t forgotten them threatening a journalist or publicly tracking the ride of a CEO for an entire room of people!

I recall that either OAuth or SAML doesn't have capabilities for logout.

I believe it's OAuth (same with JWT) in that there is no endpoint one can POST to in order to "logout," but the end-of-authorization concept exists in both OAuth and JWT via token revocation on the server-side

SAML has an actual logout endpoint

Reply on news.ycombinator.com