API Surface & Vulnerability Analysis

Pattern A — Authenticated (most endpoints):

httpClient.post(Pi_apiurl + endpoint, payload, {
  withCredentials: true,
  headers: (new Headers).set("Content-Type", "application/json")
})

Sends cookies/XSRF tokens with each request. This is the standard pattern for CRUD operations.

Pattern B — Unauthenticated (photo & file endpoints):

getImage(url) {
  return this.http.get(url, { responseType: "blob" })
  // No withCredentials, no headers, no token
}

Used for photo retrieval and some file downloads. Relies entirely on server-side access control — if missing, content is publicly accessible.

🟡 Additional Observations (Lower Confidence — Server-Side Verification Needed)

IP/MAC Tracking: Login status endpoint (InsertUpdateloginstatus) records the client's IP address, MAC address, browser user-agent, and OS. This data is transmitted in the login response and could be accessible to other users if the status endpoint has IDOR issues.

QR Code Login: A GenerateLoginQRCode / CheckQRCodeLogin flow exists. The bundle polls CheckQRCodeLogin every 5 seconds. The security of this QR-based session transfer depends on server-side implementation.

Face Verification: A /webcamtest route and CheckPhoto / RegisterPhoto API endpoints exist for facial recognition-based attendance verification. The photos are stored at /upload/{user_code}.jpg.

Draft Mode: An EnableEditOptionForEval endpoint exists alongside GetEditHistory, suggesting marks can be edited after initial submission. The edit history is queryable, but the controls around who can enable/disable editing are unclear.

Question Paper Downloads: Download/QP_Files/{filename} serves question papers. Like the PDF download, this uses no client-side auth — security depends entirely on server-side access control.