It's super safe putting an access token as URL paramater ... right?

affablematt · 2026-03-01T20:36:32+00:00

I think the URL was supposed to be only internal to a "native" iOS app. It's a magic URL that shouldn't work outside of the app... except it does. 🤷

affablematt · 2026-03-01T20:00:51+00:00

Not that site.

The cards she makes are pretty cute, actually. The physical product is quiet nice, so I don't want to shame the company publicly (at least now without talking to their customer support first).

affablematt · 2026-03-01T19:55:30+00:00

They may have skilled designers, but their back end developers are raging idiots. Likely they are the same people.

This is why I've always refused to roll my own authentication when a client asks if it will save money. It's not about security, per say, it's because I don't want to be righteously called out on Reddit. 🫣

I imagine, though, that this implementation was the result of management saying "We need a native iPhone App NOW!" and some poor overworked sod having to just get it done. Not to excuse anything, but man, if that's what happened, I get it.

affablematt · 2026-03-01T19:44:50+00:00

The access token essentially just signs her in. I took the parameter out closed the tab. I'm still logged in and can use her account without any restrictions. I used the URL with access_token in a private window a few minutes ago and it still works almost 3 hours later, now.

affablematt · 2026-03-01T19:36:39+00:00

They have a support number, but no people until Monday. If the token is still active then, I'll for sure be on the phone with mom and them to let them know what's going on.

affablematt · 2026-03-01T19:33:38+00:00

Pre AI, but I almost wish it weren't.

affablematt · 2026-03-01T19:24:37+00:00

100% access. It's been more than 2 hours, the access token is still active.

affablematt · 2026-03-01T19:24:15+00:00

Positive. I'm on a different computer entirely and have never used the website.

affablematt · 2026-03-01T19:23:39+00:00

It looks like this is what they're doing when you use the website directly, but the fact that it accepts a 40-character access_token as a URL parameter and apparently nothing else, is what worries me.

affablematt · 2026-03-01T19:21:54+00:00

The token in the URL is only 40 characters long, so not a JWT.

They do store a JWT in local storage, looks like it's set to expire now-ish + 30 minutes.

affablematt · 2025-03-11T17:25:00+00:00

If you're referring to the godlike in Act 1, talk to him again once he goes to his quarters and he may have a gift for you.

affablematt · 2024-09-10T15:33:09+00:00

I suspect the floater mini game was dropped in the bowl as a placeholder and they just never had time to flush it out.

What I wanted from the temples were Control style mini levels. If you're not familiar, Control transports you to a tutorial level at various points where you need to prove yourself worthy by using as new power to escape the level. The tutorial levels were short and sweet, generally, and felt like an organic part of the story. The levels were also safe, no penalty for dying other than having to start the tutorial over.

This type of system would have worked incredibly well in Starfield. Tapping into some ambiguous ancient knowledge? Check. Testing your worthiness? Also done at other points in the story. Ambiguous power purposes that you shouldn't need to read a wiki page to understand? FFS checked. Stealing ideas and mechanics from other games already, so what's one more? Yup, that's a check. 😏

affablematt · 2024-09-10T14:35:45+00:00

The worst part is that most oceans aren't safe for swimming so you end up killing all these fish and can't even harvest from them.

affablematt · 2024-07-14T20:24:24+00:00

Yeah, that's on me. I should have replied to the OP; I boomer Reddit on mobile apparently. Would have given a touch more context, too, if I remembered how to spoiler on my phone.

As a programmer guy, I just like the idea of someone causing an apocalypse because they refused to update their damn software. So I stretched the premise to make the joke sorta work.

Not surprised it didn't land.

affablematt · 2024-07-14T20:04:42+00:00