# Cross-site conditional response leak

Endpoints whose status, format, redirect, or timing differs by session user or content match

_Area: Web access control and IDOR. Seen in 7 disclosed reports; 5 confirmed bounties, median $1,120, range $560-$4,337; latest 2024-09-25. Updated 2026-10-23._

## How it works
A response varies depending on who is asking or whether private data matches a query, and that variation is observable from another origin. The assumption that breaks is that a cross-origin attacker cannot read a response. They don't need to read it: status code, content-type, JSON prefixing, URL redirects, connection timing, or load success/failure all leak the branch taken. Any server-side conditional that depends on the victim's session or on private content becomes a one-bit oracle the attacker can query repeatedly.

## Where it shows up
- Endpoints returning 200 vs 403 based on whether a requested ID equals the session user [E6](https://bugbountylibrary.com/r/h1%3A505424.md)
- JSON responses that add or drop an anti-hijacking prefix or change content-type on match vs mismatch [E2](https://bugbountylibrary.com/r/blog%3Atomanthony-co-uk-blog-facebook-bug-confirm-user-identities.md)
- Search/filter endpoints that redirect or rewrite the URL (e.g. adding a query param) only when results exist [E3](https://bugbountylibrary.com/r/h1%3A491473.md)[E5](https://bugbountylibrary.com/r/blog%3Aterjanq-github-io-bug-bounty-twitter-protected-tweets-exposure-efvju8i785y1.md)
- Per-user cookie-authenticated assets (images, media, fonts) embeddable cross-origin [E4](https://bugbountylibrary.com/r/h1%3A329957.md)
- Timing differences from connection reuse or fresh TCP connections to shared hosts, readable via Resource Timing [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-09-25-photos.md)

## How to review
For each authenticated endpoint, ask: does the response differ in any externally observable way between (a) the session user and another user, or (b) a matching and non-matching private query? Check status, headers, body shape, redirects, and timing. The invariant: a cross-origin caller must not be able to distinguish match from mismatch, or self from other, through status, format, redirect target, or timing. Verify anti-hijacking prefixes and content-types are applied uniformly regardless of match state [E2](https://bugbountylibrary.com/r/blog%3Atomanthony-co-uk-blog-facebook-bug-confirm-user-identities.md), and that private assets are not cookie-authenticated yet embeddable [E4](https://bugbountylibrary.com/r/h1%3A329957.md).

## Variants seen
- Status-code oracle (200 vs 403) on script-loadable JSON [E6](https://bugbountylibrary.com/r/h1%3A505424.md)
- JSON prefix/content-type oracle on identity endpoint [E2](https://bugbountylibrary.com/r/blog%3Atomanthony-co-uk-blog-facebook-bug-confirm-user-identities.md)
- Conditional URL redirect/param on search results [E3](https://bugbountylibrary.com/r/h1%3A491473.md)[E5](https://bugbountylibrary.com/r/blog%3Aterjanq-github-io-bug-bounty-twitter-protected-tweets-exposure-efvju8i785y1.md)
- Cookie-authenticated embeddable private image as identity oracle [E4](https://bugbountylibrary.com/r/h1%3A329957.md)
- Timing/connection-reuse oracle via Resource Timing, with COOP bypass [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-09-25-photos.md)

## Impact and severity
Leaked identity confirmation and membership of protected/private content (protected tweets, private photos, DM images) [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-09-25-photos.md)[E3](https://bugbountylibrary.com/r/h1%3A491473.md)[E4](https://bugbountylibrary.com/r/h1%3A329957.md)[E5](https://bugbountylibrary.com/r/blog%3Aterjanq-github-io-bug-bounty-twitter-protected-tweets-exposure-efvju8i785y1.md). Severity rises when the oracle is high-throughput (hundreds of IDs/sec [E2](https://bugbountylibrary.com/r/blog%3Atomanthony-co-uk-blog-facebook-bug-confirm-user-identities.md)) or enables binary search over private content [E3](https://bugbountylibrary.com/r/h1%3A491473.md)[E5](https://bugbountylibrary.com/r/blog%3Aterjanq-github-io-bug-bounty-twitter-protected-tweets-exposure-efvju8i785y1.md), and when framing defenses like COOP can be bypassed [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-09-25-photos.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-09-25-photos.md
- E2: https://bugbountylibrary.com/r/blog%3Atomanthony-co-uk-blog-facebook-bug-confirm-user-identities.md
- E3: https://bugbountylibrary.com/r/h1%3A491473.md
- E4: https://bugbountylibrary.com/r/h1%3A329957.md
- E5: https://bugbountylibrary.com/r/blog%3Aterjanq-github-io-bug-bounty-twitter-protected-tweets-exposure-efvju8i785y1.md
- E6: https://bugbountylibrary.com/r/h1%3A505424.md