T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:313
- Finding
- Bearer Authentication Token Exposed Through URL Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:313-329` and `SKILL.md:385-393` **Vulnerability Type**: Authentication token exposure and session fixation **Risk Level**: High The documented authentication design instructs agents to transmit a reusable bearer credential in a URL query parameter: ```typescript // Cookie bootstrap middleware - handles ?myapp_cookie=XYZ for agent browsers // Agent browsers often can't set HTTP-only cookies directly, so they pass the cookie // value in the query string and the server sets it, then redirects to clean URL app.use((req, res, next) => { const cookieValue = req.query.myapp_cookie; if (typeof cookieValue === 'string' && cookieValue.length > 0) { res.cookie('myapp_cookie', cookieValue, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', path: '/', maxAge: 30 * 24 * 60 * 60 * 1000 // 30 days }); const url = new URL(req.originalUrl, `http://${req.headers.host}`); url.searchParams.delete('myapp_cookie'); res.redirect(302, url.pathname + url.search || '/'); return; } next(); }); ``` The corresponding usage instructions are: ```bash npx atxp-call https://your-domain.com/mcp myapp_cookie '{}' ``` ```text https://your-domain.com?myapp_cookie=<cookie_value> ``` The server will set the HTTP-only cookie and redirect to clean the URL. ### Technical Analysis The cookie value is a bearer credential mapped directly to an ATXP account. Placing this credential in a query string can expose it through: - Browser history and synchronization services - Reverse-proxy, load-balancer, CDN, and web-server access logs - Application performance monitoring and analytics systems - Screenshots, copied URLs, support records, and browser automation traces - Referrer propagation under configurations that permit full or partial URL disclosure Redirecting to a clean URL only removes the credential from subsequent navigation. It does not rem ...[truncated 2474 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never place the actual session cookie or another long-lived bearer credential in a URL. - Return a short-lived, cryptographically random, single-use bootstrap code from the authenticated MCP tool. - Store only a hash of the bootstrap code and associate it with the authenticated account, creation time, expiration time, and intended purpose. - Exchange the bootstrap code through a dedicated HTTPS endpoint and consume it atomically before issuing a new session cookie. - Give bootstrap codes a very short lifetime, such as one to five minutes, and reject reused, expired, malformed, or unknown codes. - Consider using an auto-submitted HTTPS POST form or another mechanism that does not place the code in the URL. - Validate the bootstrap credential before setting any cookie to prevent arbitrary or invalid session installation. - Rotate the session identifier during bootstrap and after security-sensitive account changes. - Configure a restrictive `Referrer-Policy`, such as `no-referrer`, as defense in depth. - Scrub sensitive query parameters from application, proxy, CDN, monitoring, and analytics logs. - Require HTTPS in production and enable HSTS. Do not rely solely on `NODE_ENV` to prevent bearer cookies from being sent over plaintext transport. ]]>