T09 · Insecure Skill Coding Practices
Error
- Location
lib/api.ts:15- Finding
Request signatures do not bind the HTTP method, path, or destination
- Content
View full analysis
{ const signed = signRequest({}, privateKeyHex); const res = await fetch(`${config.serverUrl}${path}`, { method: 'GET', headers: signed.headers, }); const data = await res.json(); if (!res.ok) { throw new Error(data.error ?? `HTTP ${res.status}`); } return data; } ``` ```ts export async function apiDelete(path: string, privateKeyHex: string): Promise { const signed = signRequest({}, privateKeyHex); const res = await fetch(`${config.serverUrl}${path}`, { method: 'DELETE', headers: signed.headers, }); const data = await res.json(); if (!res.ok) { throw new Error(data.error ?? `HTTP ${res.status}`); } return data; } ``` ### Technical Analysis The signed payload contains only the request body and timestamp: ```ts JSON.stringify({ body, timestamp }) ``` It does not include the HTTP method, normalized URL path, query parameters, destination origin, or a single-use nonce. Consequently, all GE ...[truncated 2473 chars]- Remediation
View remediation