Planet Fitness: a lazy coder’s way of verifying premium access

Ax Sharma
Ax Sharma
Jun 22, 2018 · 4 min read
Image for post
Image for post
Planet Fitness website constantly recommending their “premium” tier: PF Black Card®
Image for post
Image for post
https://www.facebook.com/planetfitness/posts/10153646709739856
Image for post
Image for post
Image for post
Image for post
Image for post
Image for post

The Cause

Why does this happen?
Because… here’s the snippet from the client-side code of “membership-discounts” page. The “Verify” button present on the globally available Planet Fitness website executes a method named myFunction(), which any serious developer would find hilarious. As you can see, as long as any input of length greater than 5 characters is provided, the interstitial is simply hidden using CSS styling. In a nutshell, there is not a single network request sent to the server for actual verification! Alternatively, any kid who knows how to use Developer Tools in a modern web browser could simply “hide” the interstitial.

Image for post
Image for post

Possible Reasons

One may ask why such a lazy route for verifying premium access — on a global website, despite all this technology and APIs we have?

The Result

Members — regular or Black Card® holders, and the public aka vast majority non-members are able to get the discounts!


AxDB

Accidental eXposures Database (AxDB) — a publication…

Ax Sharma

Written by

Ax Sharma

Security Engineer | Researcher | Tech Columnist | https://hey.ax

AxDB

AxDB

Accidental eXposures Database (AxDB) — a publication featuring groundbreaking, firsthand vulnerability exposures affecting leading organisations and cyber systems, to which news media and research community can subscribe.

Ax Sharma

Written by

Ax Sharma

Security Engineer | Researcher | Tech Columnist | https://hey.ax

AxDB

AxDB

Accidental eXposures Database (AxDB) — a publication featuring groundbreaking, firsthand vulnerability exposures affecting leading organisations and cyber systems, to which news media and research community can subscribe.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch

Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore

Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store