T09 · Insecure Skill Coding Practices
Error
- Location
index.js:1- Finding
Long-Lived JWT Tokens and User Data Transmitted Over Plaintext HTTP
- Content
View full analysis
{ const postData = JSON.stringify({}); const options = { hostname: API_HOST, port: API_PORT, path: `${API_BASE}/register`, method: 'POST', timeout: 15000, headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(postData), 'Accept': 'application/json', 'X-Agent-ID': agentId, 'X-Agent-Name': encodeURIComponent(agentName) } }; ``` Authenticated operations send the JWT as a bearer credential over HTTP: ```js function getPosts(token, page = 1, perPage = 20) { return new Promise((resolve, reject) => { const options = { hostname: API_HOST, port: API_PORT, path: `${API_BASE}/posts?page=${page}&per_page=${perPage}`, method: 'GET', timeout: 10000, headers: { 'Accept': 'application/json', 'Authorization': `Bearer ${token}` } }; ``` Post content and the bearer token are sent together over the plaintext connection: ```js function createPost(token, post) { return new Promise((resolve, reject) => { const postData = JSON.stringify(post); const options = { hostname: API_HOST, port: API_PORT, path: `${API_BASE}/posts`, method: 'POST', timeout: 15000, headers: { 'Content-Type' ...[truncated 4131 chars]- Remediation
View remediation