Nimesh Thakur

icon indicating a website link https://404nation.com icon indicating an email [email protected]

icon location I break things to make them safer. Passionate about finding vulnerabilities in APIs and web applications before the bad guys do.

Results 2 comments of Nimesh Thakur

Only one user session is created instead of a new session for each different logged in user

Hi @skepticon7! I've reviewed your code and found the issue. The problem isn't actually that sessions aren't being created - multiple sessions are being created in MongoDB, but there's a...

Manual identity linking doesn't update user_metadata properly in the newly issued token

**JWT claims come from the USER + SESSION, not from the newly created IDENTITY. When linking happens, no new session is created, so claims stay the same.** ## Identity ≠...