IT24768: USER LOGIN CREDENTIALS CAN BE ACCESSED USING THE BACK BUTTON

iSeries_Media_5020603_6.zip
iSeries_Media_5020603_6
Media_IM_5020603_6
Media_IM_5020603_6

APAR status

• Closed as program error.

Error description

• All POST requests
  containing authentication credentials must be followed by a
  HTTP 302
  redirect not a HTTP 200 or browsers will be able to replay the
  request
  with the login credentials. This allows the credentials to be
  discovered.
  
  - Reproduce the issue like :
  1- login to the dashboard
  2- hit back button Confirm that the username is visible  in the
  login box ( using IE , you should not see it with chrome )
  3- hit forwad button &  go back to dashboard
  4- Click on logout  to fall on the login page
  5- Hit forward button and get a part of the dashboard header ,
  with login page displayed
  6- Hit Refresh button and resubmit the request , then confirm
  you are  logged in the dashboard without entering any password .
  

Local fix

• RTC : 552864
  EJ/EJ
  None
  

Problem summary

• Users Affected:
  All
  
  Problem Description:
  User login credentials can be accessed using the back button.
  
  Platforms Affected:
  All
  

Problem conclusion

• Resolution Summary:
  
  A code fix is provided.
  
  Delivered In:
  5020603_6
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STR B2B INTEGRA

• Fixed component ID

  5725D0600

Applicable component levels