https://ltlec.cn/archives/use-leaked-sts-token.html