T09 · Insecure Skill Coding Practices
Error
- Location
n8n_deploy.py:31- Finding
n8n API Credential May Be Disclosed Through Insecure Transport or Cross-Origin Redirects
- Content
View full analysis
Any: """Execute an API request and return parsed JSON.""" url = f"{self.base_url}/api/v1/{path.lstrip('/')}" if params: url += "?" + urlencode({k: v for k, v in params.items() if v is not None}) data = json.dumps(body).encode("utf-8") if body else None req = Request(url, data=data, method=method) req.add_header("X-N8N-API-KEY", self.api_key) req.add_header("Accept", "application/json") if data: req.add_header("Content-Type", "application/json") try: with urlopen(req) as resp: raw = resp.read() ``` ### Technical Analysis The deployment client accepts `N8N_BASE_URL` without parsing or validating its scheme, hostname, port, embedded credentials, or destination. It then attaches the privileged `N8N_API_KEY` to every outgoing request through the `X-N8N-API-KEY` header. Consequently, a base URL using plain HTTP sends the API key without transport encryption. Anyone able to observe or alter traffic between the client and the configured endpoint could recover the key. The use of `urllib.request.urlopen()` also enables standard redirect processing. The implementation does not explicitly reject redirect ...[truncated 1799 chars]- Remediation
View remediation