T09 · Insecure Skill Coding Practices
Warning
- Location
- docs/websocket.md:3
- Finding
- Bearer JWT Exposure Through WebSocket Query-String Authentication< for full event list and optional client `workflow:update` to push edits. ``` ### Technical Analysis The Skill explicitly permits a bearer JWT to be supplied as a WebSocket handshake query parameter. Query-string credentials commonly become part of request URLs recorded by reverse proxies, API gateways, load balancers, observability platforms, access logs, debugging tools, and browser or client diagnostics. TLS protects a URL while it is transmitted but does not prevent infrastructure at either endpoint from recording the decrypted request URL. A JWT is a bearer credential, so possession is generally sufficient for replay without proof that the requester is the original user. The exposure window is potentially significant because `docs/authorization.md:5-12` permits creation of long-lived bearer tokens with lifetimes of up to 31,536,000 seconds, or one year. The documentation does not require a short-lived or WebSocket-specific token and does not warn users against URL-based authentication. Sending a user-provided JWT to the selected FlowFi backend is necessary for th ...[truncated 1748 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the query-string authentication option from `docs/websocket.md`, `README.md`, and all related examples. 2. Require credentials to be supplied only through the WebSocket client's dedicated authentication payload, such as `auth.token`. 3. Prefer short-lived, narrowly scoped WebSocket tokens instead of general-purpose JWTs that authorize all protected REST operations. 4. Set conservative token lifetimes and document token rotation and immediate revocation procedures. 5. Configure proxies, gateways, WebSocket servers, and observability systems to redact authentication data and avoid logging handshake query strings. 6. Ensure error messages, traces, analytics, and client diagnostics never include complete JWT values. 7. Enforce server-side ownership checks for every workflow, execution, simulation, and smart-account identifier rather than relying solely on room subscription identifiers. 8. Consider token audience restrictions, endpoint-specific scopes, and replay-resistant session establishment. 9. Update the documentation with explicit guidance that bearer tokens must not be placed in URLs, logs, prompts, workflow variables, or other persistent records. ]]>