Instacart · Report #168223
User Information sent to client through websockets
Informativestatus
1upvotes
7 Dec 2016disclosed
How it was found
I noticed when monitoring the websocket requests that the account information of user, including user_id is sent to the client.
{"t":"d","d":{"r":8,"a":"p","b":{"p":"/carts/3671079_xjdJHqx88J435eDW5zxN/users/-KRbGN8R6uIjy6_OPx_j","d":{"id":25390626,"name":"Username}}}}