Be scared of those. They typically use client side JavaScript to read a cookie to know which username is active.
There is usually no verification of that info, so obviously it could be faked by a malicious client.
The docs say that, but it's way too easy to just trust the info rather than setup a properly secure solution.
Be scared of those. They typically use client side JavaScript to read a cookie to know which username is active.
There is usually no verification of that info, so obviously it could be faked by a malicious client.
The docs say that, but it's way too easy to just trust the info rather than setup a properly secure solution.