T09 · Insecure Skill Coding Practices
Error
- Location
main.py:57- Finding
Unrestricted API endpoint can receive account credentials and bearer tokens
- Content
View full analysis
dict: resp = self._post("/auth/signup", { "username": username, "password": password, }) self._persist_token(resp) return resp["user"] def _login(self, username: str, password: str) -> dict: resp = self._post("/auth/login", { "username": username, "password": password, }) self._persist_token(resp) return resp["user"] def _post(self, path: str, body: dict) -> dict: data = json.dumps(body).encode() req = urllib.request.Request( self.base + path, data=data, headers={"Content-Type": "application/json"}, ) return self._send(req) def _authed_post(self, path: str, body: dict) -> dict: data = json.dumps(body).encode() headers = {"Content-Type": "application/json"} if self.token: headers["Authorization"] = f"Bearer {self.token}" req = urllib.request.Request(self.base + path, data=data, headers=headers) return self._send(r ...[truncated 2154 chars]- Remediation
View remediation