Secure the reset token and the spoofable cookie, instead of refusing both calls by samelsaid · Pull Request #497 · OWASP-CTF/WebGoat

fix: authentication, CSRF, access control, secrets and XSS across the remaining lesson families

freituneir

committed

a919213

build: lombok 1.18.46 so the module compiles on the JDK 25 CI image

freituneir

committed

9585afe

fix: call User.isAdmin() in the admin role lookup

freituneir

committed

6e92cef

fix: runtime compilation, schema injection, unfiltered readObject and a few disclosures

freituneir

committed

63c6a8e

fix: quiz results were shared between users, and retire two vulnerable components

freituneir

committed

5639d70

fix: predictable tokens, cross-user request traces and unprotected cookies

freituneir

committed

3075ef5

fix: stop writing assignment secrets to the filesystem

freituneir

committed

961833f

fix: the CSRF login assignment was satisfied by an ordinary login

freituneir

committed

4a928eb

fix: stop issuing WebWolf unique codes the client can simply hand back

freituneir

committed

24c43d0

fix: WebWolf served every user's uploads to anonymous callers

freituneir

committed

f53b749

fix: JWT refresh trusted expired tokens, votes trusted an admin claim

freituneir

committed

973ee71

fix: take the deserialization gadget chain off the classpath

freituneir

committed

91e20ae

fix: stop rewarding recovered secrets in challenge 1 and the CSRF flag confirm

freituneir

committed

0891af8

fix: a second copy of the credentials script was still shipping the login

freituneir

committed

466b205

fix: draw lesson seed credentials at migration time instead of shipping them

freituneir

committed

ca78bbb

fix: remove embedded credential from challenge image asset

freituneir

committed

ada928f

Leave the signing exercise's key handout alone; fix the key generation instead

freituneir

committed

5b472f5

Leave the JWT secret lesson's signing key alone

freituneir

committed

e408575

measurement: restore the WebWolf lesson codes

freituneir

committed

ac98bf0

fix: encode stored reviews and make the pincode substitution unambiguous

samelsaid

committed

0137b6e

fix: log a throwaway value rather than a redaction in the bleeding lesson

samelsaid

committed

2a11436

fix: serve the exposed history again, with nothing usable left in it

samelsaid

committed

42b7449

fix: answer the signing verify request instead of throwing when no key was issued

samelsaid

committed

7b15234

fix: answer the server-directory request for a signed-in session again

samelsaid

committed

354395a

fix: stop rewriting the seeded passwords on every request

samelsaid

committed

bac78c3

fix: refuse a bad surname instead of scrubbing it, so the lookup still works

samelsaid

committed

9c86530

fix: keep the IDOR lesson's documented sign-in usable

samelsaid

committed

ad8f944

fix: let the lessons show their own output again

samelsaid

committed

ac40e73

fix: run a single SELECT in the DQL lesson instead of nothing at all

samelsaid

committed

9ee4b34

fix: bind reset links to their account, on top of the full patch set

samelsaid

committed

1c41cd5

fix: let a token-less reset request through, and secure the reset itself

samelsaid

committed

89fdbca

fix: exempt the reset request from the token regardless of headers

samelsaid

committed

e19d931

fix: stop refusing the spoof-cookie lesson login outright

samelsaid

committed

e58919d

Navigation Menu

Secure the reset token and the spoofable cookie, instead of refusing both calls - #497

Secure the reset token and the spoofable cookie, instead of refusing both calls#497
samelsaid wants to merge 33 commits into
OWASP-CTF:dc34-ctffrom
samelsaid:f/ceiling-c14

Commits on Aug 9, 2026

fix: authentication, CSRF, access control, secrets and XSS across the remaining lesson families

build: lombok 1.18.46 so the module compiles on the JDK 25 CI image

fix: call User.isAdmin() in the admin role lookup

fix: runtime compilation, schema injection, unfiltered readObject and a few disclosures

fix: quiz results were shared between users, and retire two vulnerable components

fix: predictable tokens, cross-user request traces and unprotected cookies

fix: stop writing assignment secrets to the filesystem

fix: the CSRF login assignment was satisfied by an ordinary login

fix: stop issuing WebWolf unique codes the client can simply hand back

fix: WebWolf served every user's uploads to anonymous callers

fix: JWT refresh trusted expired tokens, votes trusted an admin claim

fix: take the deserialization gadget chain off the classpath

fix: stop rewarding recovered secrets in challenge 1 and the CSRF flag confirm

fix: a second copy of the credentials script was still shipping the login

fix: draw lesson seed credentials at migration time instead of shipping them

fix: remove embedded credential from challenge image asset

Leave the signing exercise's key handout alone; fix the key generation instead

Leave the JWT secret lesson's signing key alone

measurement: restore the WebWolf lesson codes

fix: encode stored reviews and make the pincode substitution unambiguous

fix: log a throwaway value rather than a redaction in the bleeding lesson

fix: serve the exposed history again, with nothing usable left in it

fix: answer the signing verify request instead of throwing when no key was issued

fix: answer the server-directory request for a signed-in session again

fix: stop rewriting the seeded passwords on every request

fix: refuse a bad surname instead of scrubbing it, so the lookup still works

fix: keep the IDOR lesson's documented sign-in usable

fix: let the lessons show their own output again

fix: run a single SELECT in the DQL lesson instead of nothing at all

fix: bind reset links to their account, on top of the full patch set

fix: let a token-less reset request through, and secure the reset itself

fix: exempt the reset request from the token regardless of headers

fix: stop refusing the spoof-cookie lesson login outright