T09 · Insecure Skill Coding Practices
Error
- Location
auth/scripts/browser-login.cjs:69- Finding
Authentication Proxy Weakens Transport, Cookie, and Browser Security Controls
- Content
View full analysis
c.replace(/;\s*Domain=[^;]*/gi, '; Domain=localhost') .replace(/;\s*Secure/gi, '') .replace(/;\s*SameSite=None/gi, '; SameSite=Lax') ); } ``` ```js const server = http.createServer((clientReq, clientRes) => { // ... const proxyOptions = { hostname: TARGET_HOST, port: 443, path: clientReq.url, method: clientReq.method, headers: { ...clientReq.headers, host: TARGET_HOST, referer: (clientReq.headers.referer || '').replace( `http://localhost:${PORT}`, `https://${TARGET_HOST}` ), origin: clientReq.headers.origin ? `https://${TARGET_HOST}` : undefined, }, }; ``` ```js if (rawSetCookie) { responseHeaders['set-cookie'] = rewriteSetCookies(rawSetCookie); } delete responseHeaders['content-security-policy']; delete responseHeaders['content-security-policy-report-only']; delete responseHeaders['strict-transport-security']; delete responseHeaders['x-frame-options']; ``` ```js server.listen(PORT, () => { const loginUrl = `http://localhost:${PORT}/login?from=home`; // Auto-op ...[truncated 2144 chars]- Remediation
View remediation