7 ms·
This was definitely a concern... Each unique subdomain is checked for collision before being assigned, so no two users will receive the same endpoint. Additiona
by bozly 6y ago
This was definitely a concern... Each unique subdomain is checked for collision before being assigned, so no two users will receive the same endpoint. Additionally, it is assigned with a jwt, so even if someone was to brute force an endpoint that has been assigned to someone else, they would not be authorized to see the request data.
- emiunet 6y agoIf I knew somebody else's unique subdomain, I could set my browser cookie on my local computer to that value and it seems to just load the other subdomain just fine. I tested this with 2 different browser on my same laptop. Maybe it won't work if the other person is on another computer? I could also just set the subdomain to anything I like (by setting the cookie value) and it still works just fine. Ah no, I can still set the cookie to the other person's subdomain on another machine. Edit: add extra sentence. Edit2: format.
- bozly 6y agoOh boy, that's an embarrassing bug! Found the issue, and I'm working on fix now Edit: bug squashed - this should no longer be an issue