# Admin token verification can be bypassed using Sidekiq's web UI **URL:** \ **Category:** Bug\ **Created:** [12월 17, 2017, 8:19오후 UTC](https://meta.discourse.org/t/admin-token-verification-can-be-bypassed-using-sidekiqs-web-ui/76277 "2017-12-17T20:19:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)\ **Post date:** [12월 17, 2017, 8:19오후 UTC](https://meta.discourse.org/t/admin-token-verification-can-be-bypassed-using-sidekiqs-web-ui/76277/1 "2017-12-17T20:19:26Z")
> [@SMTP not working after changing service](https://meta.discourse.org/t/smtp-not-working-after-changing-service/76238/10): > > I wanna add that I was able to download the backup file without an email message, using sidekiq you can see the arguments of the email message that was supposed to be sent. The link of the download is included. Oops. I can reproduce that: ![screenshot](https://global.discourse-cdn.com/meta/original/3X/6/6/66ee54b04e3bca2ce7caf9fd2d74941d021b99cc.png) While this isn’t a super serious security issue (you need admin rights to exploit it), this does defeat the purpose of the email token for backup downloads. I’d assume that the same problem also exists for the token to grant admin rights to another account. I’m not sure what’s the best way to tackle this, maybe sending tokens can skip Sidekiq entirely? ---
**Author:** ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)\ **Post date:** [12월 17, 2017, 8:19오후 UTC](https://meta.discourse.org/t/admin-token-verification-can-be-bypassed-using-sidekiqs-web-ui/76277/2 "2017-12-17T20:19:33Z")
---
**Author:** ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)\ **Post date:** [12월 17, 2017, 8:34오후 UTC](https://meta.discourse.org/t/admin-token-verification-can-be-bypassed-using-sidekiqs-web-ui/76277/3 "2017-12-17T20:34:14Z")
I wouldn’t classify this as a bug. > [@fefrei](#): > > this does defeat the purpose of the email token Why does it? Only admins can access sidekiq and get the download token. An admin could visit `/admin/backups` and request a download token himself and it would have the same result… ---
**Author:** ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)\ **Post date:** [12월 17, 2017, 8:50오후 UTC](https://meta.discourse.org/t/admin-token-verification-can-be-bypassed-using-sidekiqs-web-ui/76277/4 "2017-12-17T20:50:29Z")
But the whole point of having these tokens was to protect against the worst consequences in case an admin session or password is stolen, assuming that the admin’s email account is still safe. For reference, here’s the post when the feature was announced: > [@Security breach in Discourse forum with SSO](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759/27): > > Email confirmation of backup downloads is now in, thanks to @blake. You can’t download backups simply by being logged in, you must… Be logged in as an admin → to get to /admin/backups Control the email address of an admin → to receive the download link email So this is indeed a form of two factor auth. Verifies control of the email account, plus the ability to log in as the admin. Here’s the actual email the admin will receive when the download backup button is pressed; it warns about unknown… Also, see this post for when tokens were introduced for granting admin privileges: > [@Require mail confirmation to grant admin privileges](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164): > > Currently, [downloading a backup requires clicking a link in an email as a second factor of authentication](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759/27). This is awesome! 100 I’d like to also see that when granting another user admin privileges. Without this, I don’t really see the point in confirmation before downloading a backup: Assuming an attacker hijacked an admin’s session, couldn’t he simply sign up a new account with an email address he controls, grant admin privileges to that user, and then use that user to download the backup? … If admins can simply get these tokens from Sidekiq, why do we have these tokens at all? There’re here as a form of two-factor authentication for the most sensitive actions an admin can take. ---
**Author:** ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)\ **Post date:** [12월 17, 2017, 8:58오후 UTC](https://meta.discourse.org/t/admin-token-verification-can-be-bypassed-using-sidekiqs-web-ui/76277/5 "2017-12-17T20:58:47Z")
> [@fefrei](#): > > protect against the worst consequences in case an admin session or password is stolen Right, I forgot about that scenario. ---
**Author:** ![tgxworld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tgxworld/32/106117_2.png) [@tgxworld](https://meta.discourse.org/u/tgxworld)\ **Post date:** [12월 18, 2017, 3:28오전 UTC](https://meta.discourse.org/t/admin-token-verification-can-be-bypassed-using-sidekiqs-web-ui/76277/9 "2017-12-18T03:28:13Z")
Fixed in [https://github.com/discourse/discourse/commit/97ceebb57083ae5fec3a725d929344d4ca9ce2e2](https://github.com/discourse/discourse/commit/97ceebb57083ae5fec3a725d929344d4ca9ce2e2) Thank you @fefrei for raising this! ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [12월 18, 2017, 7:25오전 UTC](https://meta.discourse.org/t/admin-token-verification-can-be-bypassed-using-sidekiqs-web-ui/76277/10 "2017-12-18T07:25:09Z")