# Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems

DevFeed: [Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems](<https://devfeed.tech/articles/angular-ing-for-authz-problematic-anti-patterns-in-single-sign-on-systems-32608.md>)

Original publisher: [Read original article](<https://eaton-works.com/2024/03/05/f500-app-hack/>)

Author: Eaton

Published: 2024-03-05T05:00:00Z

Content type: article

Language: en

Sources: [Eaton Works Feed](<https://devfeed.tech/sources/eaton-works-feed.md>)

Topics: [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [authz](<https://devfeed.tech/topics/authz.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Angular](<https://devfeed.tech/topics/angular.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [angular](<https://devfeed.tech/tags/angular.md>), [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authz](<https://devfeed.tech/tags/authz.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

The article describes an ASPEN team's research into an SSO login-flow flaw in an Angular application at a Fortune 500 healthcare company. It explains that exposed client-side API credentials and a user-search API accepting the value "all" enabled retrieval of user information; the reported vulnerability was resolved and mitigated.

## Source excerpt

(ASPEN) A critical SSO vulnerability in a Fortune 500 app risked millions of records. Learn about SSO security risks, fixes, and protecting APIs from similar attacks.