MArcomage

Hi, I discovered that I can log on to my account, without logging on actually, using an address like this: http://arcomage.netvor.sk/?location=Games_details&CurrentGame=138914

the game number is an old game of mine that has finished and doesn't exist anymore, it always leads to an Error Message, but if I press on the games menu then it let's me access my account. It's a bit weird of a scenario for a cracker to exploit it, but maybe it's worth looking into. I already tried it with another friend and I was able to access his account

Perhaps cookies are involved in this as well though

Can you explain exactly what you did? I tried doing something similar, and was unable to get your results. I copied the URL of an old game, left the game, logged out, and tried to go to the URL. I got the error about no such game, but I wasn't logged in.

You can do this if your cookies are correct (when you got authenticated). Maybe we should set a smaller cookie timeout.