HexBrain

Shopify · Report #67220

Expire User Sessions in Admin Site does not expire user session in Shopify Application in IOS

Validstatus
3upvotes
15 Jul 2015disclosed

How it was found

If an owner or an administrator clicks "Expire User Sessions" in Admin Site although you get the notification that all users where logged out, but this does not actually happens for the user that is currently logged in using the Shopify Application in IOS

This was tested on the latest Shopify app held in iTunes Store, using latest build of IOS 8.3 in iphone 6 plus

Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original