How the platform is put together.
View All Tags
We found the same hole twice, in two systems written a year and a half apart by people solving unrelated problems. Neither was a subtle cryptographic mistake. Both were the same sentence, written twice:
The browser told us which organisation this request is for, and we believed it.
An organisation's address serves three separate applications:
yourorg.rukialabs.com/ learner
yourorg.rukialabs.com/instructor authoring and grading
yourorg.rukialabs.com/admin administration
They are three builds, from three directories, with three bundles. They share a domain, a session and a design system, and a person moving between them does not sign in again.
A learner scored 120 out of 300 on a project. The admin console showed 300%. The instructor console showed 0%. The student's own course card showed 12000%.
Nobody had written a bug. Every one of those numbers came out of code that was individually reasonable.
Every organisation on the platform gets its own address and its own branding. The obvious way to build that is to fetch the branding when the app starts. We did, and it was wrong in a way that took a while to name.