T09 · Insecure Skill Coding Practices
- Location
src/config.js:18- Finding
Bearer credentials are transmitted over plaintext HTTP by default
- Content
View full analysis
Vulnerability Details
File Location:
src/config.js:18-23,src/client.js:52-70
Vulnerability Type: Plaintext transmission of authentication credentials
Risk Level: HighTechnical Analysis
The default API endpoint uses unencrypted HTTP:
javascript // Security note: the server's HTTPS certificate is not yet correctly configured. // The default therefore remains HTTP. const DEFAULT_BASE_URL = 'http://st.aidata366.com';The HTTP client attaches the account bearer token to authenticated requests regardless of whether the configured endpoint uses HTTP or HTTPS:
javascript async request(method, apiPath, opts = {}) { const { body, headers = {}, timeoutMs = REQUEST_TIMEOUT_MS } = opts; if (!_httpWarned && this.token && this.baseUrl.startsWith('http://')) { _httpWarned = true; process.stderr.write( '[warn] Current service address uses plaintext HTTP; the token will be transmitted in plaintext\n' ); } const ctrl = new AbortController(); const timer = setTimeout(() => ctrl.abort(), timeoutMs); let res; let payload = null; try { res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal, });The warning does not block the request or require confirmation. Consequently, every authenticated request made with the default configuration sends the bearer credential without transport encryption. This affects commands including
quota,submit,query,export, andlogout.Because bearer tokens grant access based on possession, a network-positioned attacker who captures the header can reuse the credential without learning a password ...[truncated 1570 chars]
- Remediation
View remediation
Remediation Suggestions
- Configure a valid HTTPS certificate for the service and change
DEFAULT_BASE_URLto an HTTPS URL. - Reject authenticated requests when
baseUrluseshttp://; a stderr warning is not an adequate control for bearer credentials. - If plaintext HTTP must be supported for local development, restrict it to loopback addresses and require an explicit development-only setting.
- Do not allow
insecure=truein production workflows. Avoid process-wide use ofNODE_TLS_REJECT_UNAUTHORIZED=0; use a narrowly scoped TLS configuration or trusted private CA instead. - Rotate existing tokens after deploying HTTPS because tokens previously transmitted over HTTP may already have been exposed.
- Consider short-lived, revocable access tokens with narrowly scoped permissions to reduce the impact of interception.
- Configure a valid HTTPS certificate for the service and change