T09 · Insecure Skill Coding Practices
- Location
src/config.js:23- Finding
Bearer Token Transmitted over Plaintext HTTP by Default
- Content
View full analysis
Vulnerability Details
File Location:
src/config.js:23;src/client.js:47-71
Vulnerability Type: Plaintext transmission of authentication credentials
Risk Level: HighVulnerable Code
js // src/config.js:23 const DEFAULT_BASE_URL = 'http://st.aidata366.com';js // src/client.js:47-71 async request(method, apiPath, opts = {}) { const { body, headers = {}, timeoutMs = REQUEST_TIMEOUT_MS } = opts; // Plaintext HTTP with a token only produces a warning. if (!_httpWarned && this.token && this.baseUrl.startsWith('http://')) { _httpWarned = true; process.stderr.write('[warn] Current service address uses plaintext HTTP; token will be transmitted in plaintext\n'); } const ctrl = new AbortController(); const timer = setTimeout(() => ctrl.abort(), timeoutMs); let res; let payload = null; try { res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal, });Technical Analysis
The built-in service endpoint uses HTTP rather than HTTPS. Authenticated API requests add the locally stored bearer token to the
Authorizationheader and send it to that endpoint.The implementation detects this condition but only writes a warning to stderr. It does not stop the request, require explicit approval, or remove the credential. Consequently, ordinary authenticated operations—including
submit,query,export,quota, andlogout—transmit the bearer token without transport encryption or server authentication.This crosses the trust boundary between the local credential store and the remote API over a network channel that can be observed or modified. The warning is not an effective security control, particularly because the Skill direc ...[truncated 1724 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the default endpoint with an HTTPS URL backed by a valid, correctly matched certificate.
- Reject authenticated requests to
http://endpoints instead of merely warning:
js if (this.token && new URL(this.baseUrl).protocol !== 'https:') { throw new NetworkError( 'Refusing to transmit an authentication token over plaintext HTTP' ); }- If HTTP support is necessary for isolated local development, restrict it to loopback addresses and require an explicit per-invocation development-only opt-in. Do not persist that exception for production credentials.
- Keep TLS certificate verification enabled. Do not use
NODE_TLS_REJECT_UNAUTHORIZED=0in production. - After deploying HTTPS enforcement, revoke or rotate tokens that may previously have crossed plaintext networks.
- Add automated tests confirming that authenticated requests fail closed for HTTP endpoints and proceed only through certificate-validated HTTPS.