T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:39
- Finding
- OAuth authorization flow does not generate or validate a session-bound state value<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–46 **Vulnerability Type**: OAuth login CSRF and authorization-response substitution **Risk Level**: Medium ### Vulnerable Code ```text 1. Go to https://developers.tiktok.com — create or select your app 2. Add redirect URI (e.g. https://localhost or your callback URL) 3. Note your Client Key and Client Secret 4. Direct user to: https://www.tiktok.com/v2/auth/authorize/?client_key=CLIENT_KEY&redirect_uri=REDIRECT_URI&response_type=code&scope=user.info.basic,video.list,video.publish,video.upload,comment.list&state=random 5. After redirect, copy the code param from the callback URL ``` ### Technical Analysis The OAuth authorization URL uses the fixed placeholder `state=random`. The setup instructions do not generate a cryptographically secure, single-use state value, bind it to the current authorization attempt, or compare it with the `state` returned to the redirect URI. The OAuth `state` parameter is intended to correlate the authorization response with the initiating session. A predictable or unvalidated value provides no effective CSRF protection. Because the user is instructed to copy only the authorization `code`, an authorization response can be processed without confirming that it originated from the flow initiated by that user. The authorization-code exchange transmits the client secret and authorization code directly to TikTok, which is necessary for the declared OAuth functionality. The security issue is not that transmission, but the missing correlation and validation around the response. ### Attack Path 1. An attacker initiates or manipulates a TikTok OAuth authorization flow using the same client application and redirect URI. 2. The attacker causes the victim to receive or copy an authorization response that was not produced by the victim's intended authorization request. 3. The Skill does not validate a session-bound state value and instructs the victim to copy only ...[truncated 749 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Generate a cryptographically secure state value for every OAuth attempt, using at least 128 bits of randomness. 2. Store the expected state in a temporary, access-controlled location associated with the current authorization attempt. 3. Require the user or callback handler to provide both the returned `code` and `state`. 4. Compare the returned state with the expected value and reject the response if it is missing, expired, reused, or mismatched. 5. Delete the stored state immediately after successful validation so it cannot be replayed. 6. Apply a short expiration period to pending OAuth attempts. 7. Prefer a local callback handler that performs validation automatically rather than requiring users to copy parameters manually. 8. Continue requiring an exact registered redirect URI and use PKCE if supported by the applicable TikTok OAuth flow. ]]>