T09 · Insecure Skill Coding Practices
Warning
- Location
references/client-sdk.md:38- Finding
Authentication Token Transmitted in URL Query String
- Content
View full analysis
`token=${await getToken()}`, queryDeps: [tokenVersion] }); ``` ``` ### Technical Analysis The example places an authentication token in a WebSocket connection URL query string. Although HTTPS protects the URL in transit, query strings are commonly captured by reverse-proxy access logs, application telemetry, error reports, browser diagnostics, and infrastructure monitoring. Anyone with access to a retained connection URL may be able to extract and replay the token. The risk is higher if the token is long-lived, bearer-based, or accepted outside the intended connection context. ### Attack Path 1. A developer copies the documented query-parameter authentication pattern. 2. A client connects using a URL containing `token=`. 3. A proxy, Worker log, monitoring platform, or error-reporting system records the URL. 4. An attacker or unauthorized operator obtains access to that record. 5. The attacker extracts the bearer token and replays it against the agent endpoint. 6. The attacker receives whatever agent access is granted to the affected user or session. ### Impact Assessment Successful exploitation may grant unauthorized access to an authenticated agent session, callable RPC methods, synchronized state, or chat data. The precise scope is limited by the permissions and lifetime of the exposed token. ]]>- Remediation
View remediation