Fixed a flaw in the Next.js/React frontend of an existing podcast platform: login credentials were passing through the URL (query string) instead of the POST request body. Reworked the form submission flow to eliminate this exposure.
The problem lay in the platform's Next.js/React frontend: submitting the login form passed the email and password through the URL query string instead of the POST request body. This kind of exposure is especially dangerous because the URL is logged server-side, kept in the browser history, cached by proxies, and potentially transmitted via the Referer header.
After locating the exact point where the credentials were being concatenated into the URL, the submission flow was redesigned to send this data in the request body. The fix was verified by inspecting the network requests to confirm that no credentials appeared in the URL anymore.
The work was deliberately kept focused on the login flow vulnerability, without touching the rest of the existing platform's architecture.
Audited the login form submission flow (Next.js/React).
Credentials transmitted via the URL query string instead of the POST request body.
Reworked the submission to transmit credentials in the request body.
Verified by inspecting network requests (no credentials in the URL anymore).
Targeted work on the login, without modifying the rest of the existing platform.
Existing frontend
Credentials out of the URL
Network verification
A brief, a repo, or a quick call - whatever works.