1
Vote

Creating tenants with a prefix only, causes security issues

description

The following scenario describes a case when a tenants are being created with a URL prefix only

Default tenant
  • url: http://localhost
  • user: admin
Tenant1
  • url: http://localhost/tenant1
  • user: administrator
When logged in as a admin user within a default tenant it is possible to access a tenant1 as a administrator without passing any credentials for tenant1.

comments

sebastienros wrote Dec 11, 2012 at 8:20 PM

When the cookie is generated, just assign the Path property with the prefix.

sebastienros wrote Dec 11, 2012 at 8:25 PM

FormsAuthenticationService line 49

Sign in to add a comment or to set email notifications