Changing token string to preview order details - IDOR
I am just wondering if there shouldnt be any addtional temp code (sent to the customer email by clicking request access code button on that url after 24 hours) required for previewing order details after 24 hours from the purchase date.
There are transactions public links (I think they are never expiring or they are not protected with additional temp code) with client details - example:
https://fancy-reserve-138687.wp1.sh/receipt/?trx_hash=142c944aa26cbf31c1a731eb00562434
I know that trying to generate all transactions hashes (rainbow tables) might not be easy (however link leakage/sharing could happen) and this kind of access to some customers details by changing one parameter in a link can be categorized as IDOR (Insecure Direct Object References) - maybe such a links should expire.
I didnt dig deeper but just highlighting this out just to make sure that it wont be any issue when it comes to customer public data access.
We will add some time constraints along with an additional temporary hash on the receipt page.
May this affect too to the customer dashboard? Or it’s just something on the receipt ?
Jorge de los Reyes it is related to a receipt only and it shouldnt be any issue AFAIK and it is just a small adjustment to make sure all data is "hidden"