T09 · Insecure Skill Coding Practices
- Location
src/config.js:16- Finding
Bearer Credentials and Sensitive Request Data Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
src/config.js:16-20, with credential-bearing requests atsrc/client.js:66-74andcli.js:312-313
Vulnerability Type: Cleartext transmission of sensitive information
Risk Level: HighComplete Code Snippets
src/config.js:16-20:javascript // Security note: the server's HTTPS certificate is not yet properly configured. // The built-in endpoint therefore remains HTTP. const DEFAULT_BASE_URL = 'http://st.aidata366.com';src/client.js:66-74:javascript res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal, });cli.js:312-313:javascript const res = await fetch(`${cfg.baseUrl}/api/v1/platform/exports/${encodeURIComponent(info.export_id)}/file`, { headers: { Authorization: `Bearer ${cfg.token}` }, signal: dlCtrl.signal });Technical Analysis
The built-in service endpoint uses unencrypted HTTP.
ApiClient.request()sends the configured bearer token in theAuthorizationheader and serializes request bodies to that endpoint. The export download path likewise sends the bearer token over the configured base URL.With the default configuration, authenticated commands—including
submit,query,quota,export, andlogout—therefore expose their traffic to passive interception and active modification. Login and registration session operations also use the same default endpoint. Submitted note URLs may containxsec_tokenquery parameters, which are included in request bodies during task submission.The runtime warning and the documentation accurately disclose this condition, but disclosure does not provide a technical security boundary and does not prevent sensitive traffic from being sent in cleartext.
Attack Path
...[truncated 1568 chars]
- Remediation
View remediation
Remediation Suggestions
- Configure a valid TLS certificate for the service and change the built-in endpoint to an
https://URL. - Reject authenticated requests to plaintext HTTP endpoints rather than merely printing a warning.
- If HTTP is required for local development, restrict it to loopback addresses such as
127.0.0.1and require an explicit, clearly named opt-in. - Apply the HTTPS requirement consistently to authentication-session creation and checking, API requests, task submission, and export downloads.
- Keep TLS certificate verification enabled. Remove or tightly constrain the process-wide
NODE_TLS_REJECT_UNAUTHORIZED=0mode because it defeats HTTPS server authentication. - After deploying HTTPS, revoke or rotate tokens that may previously have traversed untrusted networks over HTTP.
- Add automated tests verifying that credential-bearing requests fail when the effective base URL uses HTTP or when certificate validation fails.
- Configure a valid TLS certificate for the service and change the built-in endpoint to an