T09 · Insecure Skill Coding Practices
Warning
- Location
reference.md:371- Finding
Optional Authentication and Query-String Credentials for Local Media Access
- Content
View full analysis
- Remediation
View remediation
` or the existing `x-aicut-local-media-token` header. 3. Generate high-entropy, short-lived, per-session tokens rather than relying on static shared secrets. 4. Bind the media service to `127.0.0.1` or an equivalent loopback interface by default. Require an explicit security warning and hardened configuration before allowing non-loopback binding. 5. Enforce a strict allowlist of trusted origins and reject cross-origin browser requests by default. Do not combine permissive CORS settings with local-file access. 6. Apply `Referrer-Policy: no-referrer`, `Cache-Control: no-store`, and appropriate response headers to media and authentication-related responses. 7. Redact authorization headers, tokens, and media paths from application logs, proxy logs, telemetry, and error reports. 8. Keep the existing realpath and allowed-root validation, and ensure authorization is performed after canonicalization but before opening or streaming the file. 9. Prefer per-file opaque handles created through explicit user selection instead of exposing arbitrary path-based retrieval within a broad root. 10. Add automated security tests covering missing credentials, invalid and expired tokens, query-string token rejection, cross-origin requests, encoded traversal attempts, symlink escapes, and unauthorized Range requests. ]]>