5 Web Auth Vulnerabilities

# Victim browser hits attacker.example, which returns this HTML:
cat <<'HTML' > attack.html
<form action="https://bank.example/transfer" method="POST">
  <input name="to" value="attacker-account-id">
  <input name="amount" value="10000">
</form>
<script>document.forms[0].submit()</script>
HTML

# Victim's browser sends the form with their bank session cookie attached.
# Server MUST reject (403) based on Origin/Referer or missing CSRF token.

test('state-changing POST rejects cross-origin request', async ({ page, request }) => {
  await loginAs(page, 'victim@test.dev');
  const cookies = await page.context().cookies();
  const cookieHeader = cookies.map((c) => `${c.name}=${c.value}`).join('; ');

  // Simulate cross-origin submission by overriding Origin
  const res = await request.post('https://app.example/account/delete', {
    headers: {
      Cookie: cookieHeader,
      Origin: 'https://evil.example',
      Referer: 'https://evil.example/attack.html',
    },
  });

  expect(res.status(), 'Server should reject cross-origin state change').toBe(403);
});

// Network tab — inspect a state-changing request:
// 1. Look for X-CSRF-Token or _csrf in the body
// 2. Check Set-Cookie for SameSite=Lax or Strict
// 3. Verify the server rejects the request if Origin header is removed
//
// Quick console probe:
await fetch('/account/delete', {
  method: 'POST',
  credentials: 'include',
  headers: { 'Content-Type': 'application/json' },
  body: '{}',
});
// Expect: 403 Forbidden if CSRF protection is in place.

# Pre-login: grab a session cookie
SID_BEFORE=$(curl -sI https://app.example/ | grep -i 'set-cookie: sid=' | sed 's/.*sid=\([^;]*\).*/\1/')

# Log in using that same cookie
curl -X POST https://app.example/login \
  -H "Cookie: sid=$SID_BEFORE" \
  -d 'email=victim@test.dev&password=correct'

# Post-login: fetch again, compare
SID_AFTER=$(curl -sI https://app.example/ -H "Cookie: sid=$SID_BEFORE" | grep -i 'set-cookie: sid=')

# If SID_AFTER is empty (no rotation), you have session fixation
echo "Before: $SID_BEFORE"
echo "After:  $SID_AFTER"

test('session ID rotates on login', async ({ browser }) => {
  const context = await browser.newContext();
  const page = await context.newPage();

  await page.goto('/');
  const beforeLogin = await context.cookies();
  const sidBefore = beforeLogin.find((c) => c.name === 'sid')?.value;

  await login(page, 'user@test.dev', 'correct');

  const afterLogin = await context.cookies();
  const sidAfter = afterLogin.find((c) => c.name === 'sid')?.value;

  expect(sidAfter, 'Session ID must rotate on auth state change').not.toBe(sidBefore);
  expect(sidAfter).toBeTruthy();
});

// Application tab → Cookies → sid
// 1. Record the pre-login value
// 2. Log in
// 3. Record the post-login value
//
// If they match, the server isn't regenerating sessions.
// Console probe:
const before = document.cookie.match(/sid=([^;]+)/)?.[1];
// (log in manually through the UI)
const after = document.cookie.match(/sid=([^;]+)/)?.[1];
console.log({ before, after, rotated: before !== after });

# Probe: does ?next=... accept external hosts?
curl -i "https://app.example/login?next=https://evil.example/phish"

# Expected: 400 / 302 to /login (reject external)
# Vulnerable:  302 Location: https://evil.example/phish
#
# Also probe tricky encodings:
curl -i "https://app.example/login?next=//evil.example/phish"   # protocol-relative
curl -i "https://app.example/login?next=/\\evil.example"       # backslash smuggle
curl -i "https://app.example/login?next=https:%2F%2Fevil.example" # URL-encoded

test('login redirect validates target URL', async ({ page }) => {
  // External URL must be refused
  await page.goto('/login?next=https://evil.example/phish');
  await login(page, 'user@test.dev', 'correct');

  await expect(page).toHaveURL(/^https:\/\/app\.example\//);
  await expect(page).not.toHaveURL(/evil\.example/);

  // Protocol-relative smuggle
  await page.goto('/login?next=//evil.example');
  await login(page, 'user@test.dev', 'correct');
  await expect(page).toHaveURL(/^https:\/\/app\.example\//);
});

// Network tab, follow the 302 after login:
// 1. Append ?next=https://example.com to the login URL
// 2. Log in and watch the redirect chain
// 3. If Location points off-origin, this is open-redirect
//
// Console probe (without actually logging in):
const url = new URL('https://app.example/login');
url.searchParams.set('next', 'https://evil.example');
console.log('Attack URL to share with victim:', url.toString());

# Simulate browser behaviour manually
# 1. Victim clicks https://app.example/reset?token=ABC123
# 2. Page loads an external script:
curl -H "Referer: https://app.example/reset?token=ABC123" \
  https://cdn.analytics.example/track.js

# Analytics CDN now sees the token in its access logs.
# Fix: Referrer-Policy: no-referrer on the reset page
curl -I https://app.example/reset?token=ABC123 | grep -i referrer-policy

test('auth-sensitive pages use strict Referrer-Policy', async ({ page, request }) => {
  const res = await request.get('/reset-password?token=ABC123');
  const policy = res.headers()['referrer-policy'];

  expect(policy, 'Reset page must restrict referrer').toMatch(
    /^(no-referrer|same-origin|strict-origin)$/,
  );

  // Confirm outbound requests drop the referer
  const outbound: string[] = [];
  page.on('request', (req) => {
    if (!req.url().startsWith('https://app.example')) {
      outbound.push(req.headers().referer ?? '');
    }
  });

  await page.goto('/reset-password?token=ABC123');
  outbound.forEach((ref) => {
    expect(ref, 'Third party must not receive token-bearing URL').not.toContain('token=');
  });
});

// Network tab, on the reset-password page:
// Filter by "third-party" origin.
// For each third-party request, inspect the Referer header.
// A full URL with ?token=... in Referer = leak.
//
// Also check the response of the reset page:
// Look for Referrer-Policy header. Missing or "unsafe-url" = broken.

# Probe: how many attempts before 429?
for i in $(seq 1 200); do
  code=$(curl -s -o /dev/null -w '%{http_code}' https://app.example/login \
    -H 'Content-Type: application/json' \
    -d "{\"email\":\"probe$i@test.dev\",\"password\":\"x\"}")
  echo "Attempt $i → $code"
done | sort | uniq -c

# Vulnerable: all 200 attempts return 200/401 with no 429s
# Good:       429s appear within the first 10-20 attempts

test('login endpoint rate-limits brute force', async ({ request }) => {
  const attempts = 100;
  const results = await Promise.all(
    Array.from({ length: attempts }, (_, i) =>
      request.post('/api/login', {
        data: { email: `probe${i}@test.dev`, password: 'wrong' },
      }),
    ),
  );

  const blocked = results.filter((r) => r.status() === 429).length;
  expect(blocked, 'Expected most attempts to be rate-limited').toBeGreaterThan(attempts * 0.5);
});

// Console script — never run against systems you don't own.
const probe = async (n = 50) => {
  const codes: number[] = [];
  for (let i = 0; i < n; i++) {
    const r = await fetch('/api/login', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email: `p${i}@x.io`, password: 'x' }),
    });
    codes.push(r.status);
  }
  console.table(codes.reduce((acc, c) => ({ ...acc, [c]: (acc[c] ?? 0) + 1 }), {}));
};
probe();
// Ideal output: { 401: 5, 429: 45 }
// Broken:       { 401: 50, 429: 0 }