After login, the Ravens’ site gives you a session token shaped user-<number>, and your number is 2. The session token is not random — it is derived directly from your account number. The leader, admin, is number 1.
The Ravens account page shows your data based on a session token. Your token is user-2, and you notice its shape is predictable — user then a number, with nothing random. The admin session token is guessable.
Impersonate the leader’s session and open his account without knowing his password.
You impersonated the admin session by changing the number in the predictable session token.
Why the solution worked
The session token was predictable, derived from the account number, so anyone can change the number and impersonate another session. A session token must be long, random, and unguessable, generated by a secure generator and stored on the server tied to the user, so it carries no editable information inside it. Add the cookie flags HttpOnly, Secure and SameSite, and invalidate the session on logout.
The root cause
The session token is built predictably from the user id instead of a long random value, so an attacker can compute any user token and impersonate the session.
How the code is fixed
The token must be a random secret that carries no meaning and is not derived from known data. Storing it server-side separates the token from the user’s identity.
Vulnerable code
function login(res, user) {
// Predictable: anyone can forge user-<other id>.
res.cookie('session', 'user-' + user.id);
}
function currentUser(req) {
const id = req.cookies.session.split('-')[1];
return db.user(id);
}
Safe code
function login(res, user) {
// Random, unguessable, stored server-side tied to the user.
const token = crypto.randomBytes(32).toString('hex');
sessions.set(token, user.id);
res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'lax' });
}
function currentUser(req) {
const id = sessions.get(req.cookies.session);
return id ? db.user(id) : null;
}
Impact in the real world
Predictable session tokens allow impersonating any user with no password and have led to mass account takeover.
How defenders detect it
Defenders generate long cryptographically random session tokens, alert on sequential token patterns in requests, and bind the session to a client fingerprint.
