Steal the account JSON cross-origin
The /api/account endpoint reflects the request's Origin and allows credentials, so any website could read it. Make the request as a foreign origin, confirm the reflection, and capture the secret from the JSON, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
Because the API reflected your Origin and allowed credentials, a page on any domain could read a logged-in victim's account JSON — the browser would permit it on the server's say-so. Restrict CORS to a strict allow-list of known origins, never reflect arbitrary ones, and never combine that with credentials.
Show solution
cd /home/student
curl -s -i -H 'Origin: https://evil.example' http://127.0.0.1:8080/api/account | grep -i access-control
curl -s -H 'Origin: https://evil.example' http://127.0.0.1:8080/api/account | tee loot.txt