T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:53- Finding
Bearer Tokens and Authorization Headers Persisted in Plaintext
- Content
View full analysis
None: """Save request history to file.""" # Keep only last 100 entries if len(history) > 100: history = history[-100:] try: with open(HISTORY_FILE, 'w') as f: json.dump(history, f, indent=2) except IOError as e: print(f"Warning: Could not save history: {e}") ``` ```python request_data = { "method": method, "url": url, "headers": headers, "timestamp": datetime.now(timezone.utc).isoformat() } ``` ```python # Add to history add_to_history(request_data, { "status_code": response.status_code, "reason": response.reason, "elapsed_ms": response_data["elapsed_ms"] }) ``` ```python elif args.auth == "bearer" and args.token: headers["Authorization"] = f"Bearer {args.token}" # ... if args.save_template: request_data = { "method": "GET", "url": args.url, "headers": headers, "auth": args.auth, "username": args.username if args.auth == "basic" else None, "token": args.token if args.auth == "bearer" else None } save_template(args.save_template, request_data) ``` ```python def save_template(name: str, request_data: Dict[str, Any]) -> bool: """Save a request as a template.""" template_file = TEMPLATES_DIR / f"{name}.json" try: with open(template_file, 'w') as f: json.dump(request_data, f, indent=2) ``` ### Technical Analysis Bearer authentication inserts the token into the request's `Authorization` header. The complete header dictionary is then included in `request_data` and serialized to `~/.http-request-builder/history.json`. Arbitrary sensitive headers supplied through `--header`, including `Authori ...[truncated 1809 chars]- Remediation
View remediation