NetSPI/django.nV

OWASP #2 - Broken Auth and Session Management

nafod opened this issue · 1 comments

nafod commented

Could be in the form of poor password hashing, enumeration on a password recovery form, weak tokens for password recovery, etc

sethlaw commented

HttpOnly AND Mass Assignment both exist. Tutorial documents mass assignment during the reg process. Might want to change this eventually, but okay for now.