A Token You Can Read: Why a Browser Token Is Not a Secret Box
The challenge
Web apps often hand your browser a long token to remember who you are. It looks like a random scramble, but the middle part is not secret writing - it is just a reversible code anyone can turn back into plain text. The workbench unscrambles it for you. Read it and submit the username it carries.
What you'll learn
- Understand that a browser token's middle part is a reversible code, not a secret
- Turn an encoded token segment back into plain readable text
- Find and read the username inside a decoded token
- Explain why passwords and private details must never be hidden in such a token
- Recognise that anyone with a copy of the token can read its contents
Skills tested
Prerequisites
- Apps give your browser a token to remember who you are
- Some text codes are reversible into plain text
How it works
When you sign in to a website, it often gives your browser a long token to carry on each visit so the site remembers who you are. That token comes in three parts separated by dots. The middle part holds details about you, and at first glance it looks like a meaningless scramble of letters and numbers.
The important thing to learn is that this scramble is not a secret message locked with a key. It is written in a reversible code, a common way of packing text so it travels safely. Turning it back into plain text needs no password and no special trick - the workbench does it in one step and shows {"user":"guest42","role":"guest"}. So the username inside is guest42, and it was never really hidden.
That is the whole lesson: a token like this is readable by anyone who has a copy of it. It is fine for it to carry your username or your role, because those are not secrets. But a real secret, like a password, must never be tucked inside one, because it would simply be sitting there in plain view.
Common mistakes
- Thinking the token is a locked secret. The middle part is a reversible code, not a password-protected message; no key is needed.
- Trying to crack or guess it. There is nothing to crack - the workbench turns it straight into plain text.
- Reading the wrong field. The answer is the value of
user, notrole. - Changing how you type the answer. Submit the username exactly as shown:
guest42.
How to defend against it
Because anyone with a copy of the token can read it, builders should keep only non-secret details inside.
- Never place a password or other private secret inside a token the browser holds.
- Keep only what is safe to be seen, such as a username or a role, and look up anything sensitive on the server.
- Make tokens expire after a while so an old copy stops working.
- Send and store tokens carefully so they are harder to steal in the first place.