T09 · Insecure Skill Coding Practices
- Location
src/config.js:18- Finding
Bearer Token and Account Data Transmitted over Plaintext HTTP by Default
- Content
View full analysis
Vulnerability Details
File Location:
src/config.js:18-21, with authenticated transmission insrc/client.js:49-76andcli.js:335-337
Vulnerability Type: Plaintext transmission of authentication credentials
Risk Level: HighVulnerable Code
javascript // The service currently lacks a correctly configured HTTPS certificate. // The default therefore remains HTTP. const DEFAULT_BASE_URL = 'http://st.aidata366.com';Authenticated API requests subsequently attach the bearer token:
javascript res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal, });CSV export requests independently use the same plaintext destination and credential:
javascript const res = await fetch( `${cfg.baseUrl}/api/v1/dy/comments/sessions/${encodeURIComponent(sessionId)}/export`, { headers: { Authorization: `Bearer ${cfg.token}` }, signal: dlCtrl.signal });Technical Analysis
The built-in service URL uses HTTP rather than HTTPS. Once a user authenticates, most API operations include a reusable bearer token in the
Authorizationheader. The CSV export path also attaches that token directly.Although
src/client.jsprints a warning when a token is sent over HTTP, the warning does not block the request or require explicit consent. HTTP provides neither transport confidentiality nor authenticated server identity. Any party with an on-path network position can inspect the bearer token, observe returned comment data, or modify requests and responses.This is reachable under the standard documented workflow because users are instructed to register or log in, after which the token is stored and automatically used with the default base URL.
Attack Path
- The user registers or logs in, and t ...[truncated 1359 chars]
- Remediation
View remediation
Remediation Suggestions
- Configure the service with a valid TLS certificate and change
DEFAULT_BASE_URLto an HTTPS URL. - Reject authenticated requests to HTTP endpoints by default rather than merely printing a warning.
- If private development endpoints must support HTTP, require an explicit per-request unsafe override and clearly distinguish it from production configuration.
- Never allow the unsafe HTTP override for the built-in public service endpoint.
- Keep TLS certificate verification enabled. Remove or tightly restrict the process-wide
NODE_TLS_REJECT_UNAUTHORIZED=0mechanism. - Rotate tokens that may previously have crossed untrusted networks over HTTP.
- Consider short-lived, scoped tokens and server-side revocation controls to reduce the impact of credential interception.
- Add tests verifying that requests carrying an
Authorizationheader are rejected unless the effective URL uses validated HTTPS.
- Configure the service with a valid TLS certificate and change