Don’t send live session tokens to support
The Okta support breach worked because customers uploaded HAR files with valid sessions inside. Clean them first.
Okta disclosed last month that an attacker got into its support case system and viewed files customers had uploaded. Many were HAR files, browser recordings that support teams ask for when debugging. HAR files include cookies and session tokens. The attacker used them to hijack sessions at some customers. Okta later said the way in was a service account whose credentials had been saved in an employee’s personal Google profile on a work laptop.
Two lessons, one for each side.
When you send a HAR file to any vendor:
- Remove cookies and authorization headers first. Several vendors offer HAR sanitizer tools.
- Or log out right after recording, so the session in the file is dead.
When you run a support system:
- Treat uploaded files as secrets. Delete them when the case closes.
- Sanitize HAR files automatically on upload.
- Keep work credentials out of personal browser profiles on company devices.
Some customers caught this early because they noticed sessions being used from strange places. That’s the logging paying off.