T09 · Insecure Skill Coding Practices
Error
- Location
runner.cjs:92- Finding
OAuth Authorization Code Routed Through an Unverifiable Third-Party Callback Service
- Content
View full analysis
setTimeout(resolve, 1000)); try { const response = await fetch(`${CALLBACK_SERVER}/api/token/${state}`); if (response.ok) { const data = await response.json(); code = data.code; break; } } catch (e) { // Continue polling } } if (!code) { throw new Error("Authorization timeout. Please try again."); } ``` ### Technical Analysis LinkedIn sends the OAuth authorization code to a hosted Railway service rather than directly to the local client. The client then retrieves the code by polling an endpoint keyed only by the OAuth state value. The callback server's implementation is not included in the audited project. Consequently, the audit cannot verify its authentication, authorization, code retenti ...[truncated 2261 chars]- Remediation
View remediation
/callback`. 2. Use PKCE with a cryptographically random `code_verifier` and corresponding `code_challenge` where supported. 3. If LinkedIn offers a device authorization flow appropriate to this client, prefer it over a shared callback relay. 4. If the relay must remain: - Publish and independently review its source code. - Authenticate callback retrieval rather than treating knowledge of state as authorization. - Bind each record to a separate high-entropy client secret or public-key proof. - Encrypt temporary authorization records. - Enforce short expiration and atomic one-time consumption. - Never log authorization codes or tokens. - Document ownership, hosting controls, retention policy, and incident response procedures. 5. Revoke existing authorizations and reauthorize users after replacing or hardening the callback infrastructure. ]]>