T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:103- Finding
API Authentication Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/api/search.js:59-62, 104-107;src/api/comment.js:38-41, 67-70;src/api/post.js:23-26, 50-53;src/api/hot.js:18-23;src/utils/request.js:103-109, 130-135
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: MediumComplete Code Snippets
The search API places the token in the parameter object for both task creation and result retrieval:
js // src/api/search.js:59-62 const params = { _: Date.now(), token: token, };js // src/api/search.js:104-107 const params = { _: Date.now(), token: token, keyword: keyword,The comment API follows the same pattern:
js // src/api/comment.js:38-41 const params = { _: Date.now(), token: token, };js // src/api/comment.js:67-70 const params = { _: Date.now(), token: token, url: url,The hot-list API also includes the token in GET parameters:
js // src/api/hot.js:18-23 async () => { const res = await getJson("/api/douyin/hot-search", { _: Date.now(), token: token, }); return res.data; },The request utility serializes these objects directly into the URL for POST requests:
js // src/utils/request.js:103-109 params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL,It does the same for GET requests:
js // src/utils/request.js:130-135 params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath,The audit also confirmed the same parameter pattern in
src/api/post.js:23-26andsrc/api/post.js:50-53.Technical Analysis
GUAIKEI_API_TOKENis a reusable authentication credential. Every API module passes it as a URL parameter, and the shared request utility serializes all parameters into the request path.HTTPS encrypts the ...[truncated 2112 chars]
- Remediation
View remediation
Remediation Suggestions
-
Move authentication to a header
- Send the credential as
Authorization: Bearer <token>, or use a dedicated header such asX-API-Tokenif required by the service. - Apply the header centrally in
src/utils/request.jsso all API operations use the same secure mechanism.
- Send the credential as
-
Remove the token from request parameters
- Delete
token: tokenfrom the parameter objects insrc/api/search.js,src/api/comment.js,src/api/post.js, andsrc/api/hot.js. - Ensure neither GET nor POST URLs contain authentication material.
- Delete
-
Avoid mutating and serializing sensitive parameter objects
- Build query strings from an explicit allowlist of non-sensitive parameters.
- Reject keys such as
token,authorization,secret, andpasswordif they are accidentally supplied as URL parameters.
-
Harden logging infrastructure
- Configure the API server, reverse proxies, gateways, and observability services to redact existing
tokenquery parameters. - Avoid logging complete request URLs where query values are not operationally necessary.
- Restrict access to historical logs and establish appropriate retention limits.
- Configure the API server, reverse proxies, gateways, and observability services to redact existing
-
Rotate exposed credentials
- Treat tokens previously sent in query strings as potentially logged.
- Revoke and rotate existing tokens after deploying header-based authentication.
- Review logs for suspicious or unexpected token use.
-
Add regression tests
- Assert that generated request paths never contain
token=. - Assert that the authorization header is present and that diagnostic output does not disclose its value.
- Assert that generated request paths never contain
-