T09 · Insecure Skill Coding Practices
Error
- Location
scripts/n8n_api.py:19- Finding
API Key Exposure Through Unvalidated Transport and Redirects
- Content
View full analysis
Dict[str, Any]: """Make API request""" url = f"{self.base_url}/api/v1/{endpoint.lstrip('/')}" response = self.session.request(method, url, **kwargs) ``` ### Technical Analysis The client obtains `N8N_BASE_URL` from an environment variable without validating its scheme, hostname, port, or embedded credentials. It then places the n8n API key in a persistent session header and sends requests to the resulting URL. Consequently, an `http://` base URL causes the API key and API traffic to be transmitted without transport encryption. An attacker able to observe or modify the network path could capture the key or alter API responses. The `requests` library also follows redirects by default. Because the API key is stored in the custom `X-N8N-API-KEY` session header, a redirect may cause sensitive credentials to cross the originally configured trust boundary. The implementation does not disable redirects or verify that redirect destinations retain the expected HTTPS scheme and trusted origin. ### Attack Path 1. A user configures an HTTP n8n URL, or an attacker modifies the `N8N_BASE_URL` environment variable. 2. The client constructs an API URL directly from that value. 3. The client attaches the `X-N8N-API-KE ...[truncated 1038 chars]- Remediation
View remediation