T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:98- Finding
Authentication Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/api/search.js:59-62, 104-107;src/api/comment.js:38-40, 67-70;src/api/post.js:23-25, 50-53;src/api/hot.js:19-22;src/utils/request.js:98-117
Vulnerability Type: Sensitive credential exposure through request URLs
Risk Level: MediumVulnerable Code
src/api/search.js:59-62:js const params = { _: Date.now(), token: token, };src/api/search.js:104-107:js const params = { _: Date.now(), token: token, keyword: keyword,src/api/comment.js:38-40:js const params = { _: Date.now(), token: token, };src/api/comment.js:67-71:js const params = { _: Date.now(), token: token, url: url, limit: limit, };src/api/post.js:23-25:js const params = { _: Date.now(), token: token, };src/api/post.js:50-54:js const params = { _: Date.now(), token: token, url: url, limit: limit, };src/api/hot.js:19-22:js const res = await getJson("/api/douyin/hot-search", { _: Date.now(), token: token, });src/utils/request.js:98-117:js params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Accept-Encoding": "identity", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData);Technical Analysis
Every API method places
GUAIKEI_API_TOKENin a parameter object that is serialized directly into the URL query string. Although the requests use HTTPS, TLS only protects the request in transit. It does not prevent the full request target from being recorded by the destination server, reverse pr ...[truncated 1886 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom every URL parameter object. -
Transmit credentials using an authorization header, for example:
js headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", "Accept-Encoding": "identity", } -
Refactor
getJsonandpostJsonso authentication is supplied separately from ordinary query parameters. -
Never include tokens in exception messages, telemetry, filenames, or debug output.
-
Configure the API server, proxies, and monitoring systems to redact sensitive query parameters from historical and future logs.
-
Rotate tokens that have already been used by the affected implementation because they may exist in retained logs.
-
Add automated tests asserting that generated request paths never contain
token,access_token, or other credential parameters. -
Apply short token lifetimes, revocation support, rate limits, and narrowly scoped permissions to reduce the consequences of future exposure.
-