T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:15- Finding
API Token Exposure Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
"}' ``` Prefer configuring the environment outside the command invocation when the execution platform supports secret injection. 2. **Use an authentication header if supported by JustOneAPI.** For example: ```js const requestInit = { headers: { accept: "application/json", authorization: `Bearer ${token}`, }, method: operation.method, }; ``` The token must then be removed from `params`, the operation’s query-parameter definition, and the generated URL. The exact header scheme must follow the provider’s official authentication specification. 3. **If the upstream API strictly requires query authentication**, document this constraint and reduce exposure: - Never log the complete request URL. - Configure clients, gateways, reverse proxies, tracing systems, and server access logs to redact the `token` parameter. - Disable verbose HTTP debugging in production. - Ensure exception and telemetry systems sanitize URLs before storage. - Avoid redirects that could propagate query parameters. - Apply short expiration periods, minimal scopes, account-level rate limits, and regular rotation. - Revoke and replace tokens suspected of appearing in historical process or URL logs. 4. **Reject token injection through `--params-json`.** The current `injectToken()` function preserves `params.token` when supplied by users, allowing the credential to be embedded in a broader command-line JSON value. Reserve auth ...[truncated 295 chars]