Documented incidentDisclosed 2023-10-19OktaEngineering postmortem

Stolen credential opens Okta's support system, where uploaded HAR files held customer session tokens (2023)

Support portal allowed unredacted HAR file uploads containing session tokens; threat actor hijacked customer administrator accounts.

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Audit trail missing actor, target or decisionAfter something goes wrong nobody can tell who or what took the action, on which object, or why.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Redact secrets from customer-uploaded diagnosticsStrip or reject session tokens and cookies in uploaded HAR and log files before they are stored or viewed by support staff.
  • Harden support tooling identitiesKeep service-account credentials out of personal browsers, scope them minimally, and bind or shorten customer session lifetimes so stolen tokens lose value quickly.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern