HackerOne · Report #353
Session not expired on logout
Validstatus
$100bounty
22upvotes
19 Apr 2014disclosed
How it was found
hackerone.com website is not expiring the user's session immediately after logout.
Steps to verify:
- Log into the website - hackerone.com.
- Capture any request. For ex, profile edit page using burp proxy.
- Logout from the website.
- Replay the request captured in step 3 and notice it displays the proper response.