Posted: 4/23/2023 5:47 PM
eien86
He/Him
Judge, Expert player (4145)
🇨🇭 Switzerland
Joined: 3/21/2021
Posts: 352
Location: 🇨🇭 Switzerland
NES TASer of 2023 PC TASer of 2023 NES TAS of 2023 PC TASer of 2021
Just letting you know that you can trigger an error when logging in, if you change the value of "RememberMe" after clicking "log in". This sends both values which triggers an error. This happened to me on Android+Chrome What's concerning to me, though, is that the form returns with all credentials as plain text. This means the pass went to the server and back without any type of obfuscation. Pretty sure this isn't too safe.
Posted: 4/23/2023 6:24 PM
(Edited: 4/23/2023 6:32 PM)
Masterjun
He/Him
Site Developer, Expert player (2124)
🇩🇪 Germany
Joined: 10/12/2010
Posts: 1187
Location: 🇩🇪 Germany
Exotic platforms TAS of 2020 Speedy TAS of 2018 PC TAS of 2018 Glitchy TAS of 2015 TASer of 2014 SNES TASer of 2014 TAS of 2014 SNES TAS of 2014 Funny TAS of 2014 Glitchy TAS of 2014 TASer of 2013 SNES TASer of 2013 NES TAS of 2013 SNES TAS of 2012 Funny TAS of 2012
eien86 wrote:
What's concerning to me, though, is that the form returns with all credentials as plain text. This means the pass went to the server and back without any type of obfuscation. Pretty sure this isn't too safe.
That's not quite correct. As long as you're using HTTPS (which we and most pages are), nothing is sent as plain text. This is how every safe site that uses a Username+Password login works. The form data being shown to you is meant as a recovery option. With this 400 error the server denied your request due to bad caching on your browser's part. The idea of it being due to the "Remember me" option is just a coincidence in this case. (The reason you see it sending both "true" and "false" is due to how HTML checkboxes work with ASP.NET. Because an unchecked box will send nothing, not even false, the framework inserts a hidden input field that is always false. This way it always sends "false" no matter what, and then also appends "true" if the actual checkbox is checked.) If you're still concerned about security, our whole source code is open source and available on GitHub here: https://github.com/TASVideos/tasvideos , or by clicking the site version number at the bottom of each page. We're using Razor Pages with the default ASP.NET Microsoft.AspNetCore.Identity sign in method. ( https://github.com/TASVideos/tasvideos/blob/7efe9e5edf8999b15051fdbba765eb14bef77d6f/TASVideos.Core/Services/SignInManager.cs )
Warning: Might glitch to credits I will finish this ACE soon as possible (or will I?)
Posted: 4/23/2023 6:32 PM
eien86
He/Him
Judge, Expert player (4145)
🇨🇭 Switzerland
Joined: 3/21/2021
Posts: 352
Location: 🇨🇭 Switzerland
NES TASer of 2023 PC TASer of 2023 NES TAS of 2023 PC TASer of 2021
Alrighty, thanks for the clarification. I just had to make sure :)