T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:24- Finding
API Authentication Token Exposed Through URL Query Parameters
- Content
View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The resulting URL includes the credential in the following form: ```text https://api.justoneapi.com/api/douyin-xingtu/.../v1?token=&... ``` ### Technical Analysis The helper injects the authentication token into `params.token`. Because the token is declared as a query parameter, `applyQueryParams()` places it in `url.searchParams`, and the complete URL is then supplied to `fetch()`. HTTPS encrypts the URL while it is in transit between the client and server, so this is not plaintext network transmission. However, query strings are commonly captured outside the encrypted transport channel by: - API gateway, reverse-proxy, and origin-server access logs - Application performance monitoring and network diagnostic systems - Error reports and request traces - Debugging or observability tools that record complete request URLs - Browser or tooling history if the URL is reproduced outside this helper The documented invocation also passes the ...[truncated 2013 chars]- Remediation
View remediation