Share
ReportHello,
I am running into a security issue in my Power Apps Portal application. I have users with different permissions. And I do the following test:
1. I signed in with an administrator user
2. I copied the session cookie
3. I logged out the administrator user
4. I signed in with another user with less privileges.
5. With a local proxy, I changed the session cookie of the less privileged user
6. I have administrator privileged now.
As I have seen, when I make the logout of the administrator user, the response have a set-cookie header, but this header is empty, and the session cookie is not invalidated.
¿There is a way to invalidate a session cookie when the user use the logout function?
Thank you,
Best regards
All responses (
Answers (
60
