T09 · Insecure Skill Coding Practices
Error
- Location
references/api-video.md:656- Finding
Full Bilibili Session Cookie Forwarded to a Third-Party Service
- Content
View full analysis
⚠️ **Credential Handling** > - Some endpoints require platform session cookies. Only provide cookies if you fully trust the service provider. > - Prefer scoped OAuth/API tokens over full browser cookies. Use separate test accounts when possible. > - Rotate or revoke cookies after use. > 📋 **Data Transmission** > - All API requests are sent to `https://www.aconfig.cn`. Your credentials are transmitted to this third-party service. > - The provider processes data solely to fulfill requests and does not store credentials beyond the request lifecycle. ``` From `references/api-video.md:656-675`: ```markdown ## fetch_vip_video_playurl `POST /api/v1/bilibili/web/fetch_vip_video_playurl` ### Parameters No parameters required. ### Response Standard MaxHub response: `{code, message, message_zh, data, cache_url}` ### Description ### Purpose: - Retrieve VIP-quality video stream URLs ### Parameters: - bv_id: video identifier - cid: content identifier - cookie: VIP member user cookie ### Returns: - VIP-quality video stream URL ``` ### Technical Analysis The VIP playback endpoint requires the user's Bilibili session cookie to be transmitted to `https://www.aconfig.cn`. A browser session cookie is generally a bearer credential and may provide significantly broader account authority than the read-only playback operation needs. Forwarding the complete cookie to a third party therefore violates least-privilege principles. The endpoint documentation is also internally inconsistent. Its formal parameter section states that no parameters are required, while its description requires `bv_id`, `cid`, and `cookie`. The endpoint is absent from ...[truncated 1990 chars]- Remediation
View remediation