Token Exposure in URL

What Is Token Exposure in URL?

Putting a session token in a URL leaks a value that authenticates whoever holds it. URLs land in server and CDN access logs, browser history, link-preview unfurlers, and the Referer header sent to third-party assets. You'll harvest live tokens from an analytics referrer dump and read a victim's private documents with no password involved. Then you move the token into a Set-Cookie header with HttpOnly , Secure and SameSite=Strict , and invalidate every token that already leaked, because patching the code does not revoke what attackers collected.

What You'll Learn in Token Exposure in URL

• Recognize that any value an attacker could replay to authenticate as the user (session token, API key, reset token, signed-URL parameter) belongs in a cookie or header, never in a URL
• Understand the difference in leak surface between URLs (logged, forwarded, recorded by many parties) and cookies (browser-server channel only)
• Apply the HttpOnly + Secure + SameSite=Strict cookie pattern for session tokens and equivalent authenticators
• Invalidate every session token that already leaked into logs and referrers, since fixing the code does not retroactively revoke tokens attackers have already harvested
• Audit every URL generator (magic-link sign-in, signed-share URLs, download tokens, password-reset URLs, OAuth callbacks) for authenticators that should be moved off the URL

Token Exposure in URL — Training Steps

1. Watch a sign-in

   Bob has been poking at Corveil, a shared-workspace app that businesses run their documents on. Before he looks for a way in, he wants to see exactly what the app does when someone signs in. He registers a throwaway account so he can log in as himself and watch every step. He starts on the sign-in page.

2. Sign in and follow the redirect

   Bob signs in to his throwaway account, the way any user would. His password manager fills the saved credentials. Corveil signs him in and redirects him to his workspace dashboard. The browser lands on the page it sent him to.

3. The token is in the address bar

   Bob is on his dashboard now, and something jumps out at him: the sign-in dropped his session token straight into the URL. That one string is his whole logged-in session. He does not need to break into anything. He just needs the places these URLs pile up.

4. Harvest the referrer logs

   Bob never sends Corveil a single malicious request. Instead he buys a month of referrer logs from an analytics reseller, the kind of vendor whose tracking tag sits on Corveil's dashboard and quietly records the full referring URL of everyone who loads it. He opens a terminal next to the browser and greps that feed for the dashboard sign-in links.

5. Replay a stolen session

   Bob picks one victim out of the dump, Maya Okafor, and takes her session token. He points the API Tester at Corveil's document API and carries her stolen token in a Cookie header, exactly as her browser would. If the server accepts it, he is reading Maya's private workspace without ever knowing her password.

6. Her session is his

   The server took the stolen token as a genuine login and answered. Bob is now reading Maya's private documents from a plain API call, with no account of his own and no password.

7. Knowledge check

   Bob can do this for thousands of users at once, all from logs he bought. Be precise about why a token in a URL is so much worse than ordinary data in a URL.

8. The security alert

   You own Corveil's sign-in service. Overnight, detection flagged a run of sessions being replayed from unfamiliar locations and emailed you the finding. Read what it caught, then open the code.

9. Open the sign-in handler

   The handler that finishes sign-in and redirects the user to their dashboard is what you need to change. Open it and look at how it builds the redirect.

10. Spot the leak

    The handler mints a fresh session, then pastes its id straight into the redirect target's query string. The browser follows that URL, and from that moment the token is everywhere the address goes.