T09 · Insecure Skill Coding Practices
- Location
src/config.js:17- Finding
Bearer Credentials Are Transmitted over Plaintext HTTP by Default
- Content
View full analysis
Vulnerability Details
File Location:
src/config.js:17, with credential transmission atsrc/client.js:48-71andcli.js:329-331
Vulnerability Type: Plaintext transmission of authentication credentials
Risk Level: HighTechnical Analysis
The built-in service URL uses plaintext HTTP:
js const DEFAULT_BASE_URL = 'http://st.aidata366.com';This value becomes the effective service URL unless the user explicitly supplies an override:
js return { baseUrl: overrides.baseUrl || process.env.XHS_PLATFORM_BASE_URL || file.base_url || DEFAULT_BASE_URL, token: overrides.token !== undefined ? overrides.token : (file.token || ''), insecure: process.env.XHS_PLATFORM_INSECURE === '1' || file.insecure === true, };Authenticated API requests add the user's bearer token to the request headers regardless of whether the URL uses HTTP or HTTPS:
js res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal, });The CSV export path also sends the same credential over the configured URL:
js const res = await fetch( `${cfg.baseUrl}/api/v1/comments/sessions/${encodeURIComponent(sessionId)}/export`, { headers: { Authorization: `Bearer ${cfg.token}` }, signal: dlCtrl.signal });The client emits a warning when HTTP is used, but it does not block the request. Consequently, the persistent account token crosses the local-machine trust boundary through an unauthenticated and unencrypted network channel.
This is not evidence that the configured server intentionally steals credentials. It is a reachable transport-security vulnerability that allows an independent network-path attacker to capture or modify them.
Attack Path
- The user registers or logs in, causing an account bearer tok ...[truncated 1350 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the production default with an HTTPS endpoint that has a valid, hostname-matching certificate.
- Refuse to attach bearer credentials to plaintext HTTP requests.
- Permit HTTP only for explicitly recognized loopback development targets such as
127.0.0.1,localhost, or::1, and avoid using production credentials in that mode. - Treat the existing stderr message only as supplemental notice, not as a security control.
- Validate the effective URL using the standard URL parser rather than a string-prefix check.
- Prevent HTTPS-to-HTTP redirect downgrades for authenticated requests.
- If the service cannot immediately support HTTPS, use a mutually authenticated secure tunnel rather than sending credentials directly over the public Internet.
- After deploying secure transport, revoke or rotate tokens that may previously have traversed plaintext networks.