T09 · Insecure Skill Coding Practices
Warning
- Location
- references/route-handlers.md:81
- Finding
- Authentication Cookie Token Disclosed in JSON Response<![CDATA[ ## Vulnerability Details **File Location**: `references/route-handlers.md:81-84` **Vulnerability Type**: Authentication credential disclosure **Risk Level**: Medium ### Vulnerable Code ```tsx const cookieStore = await cookies() const token = cookieStore.get('token') return Response.json({ query, token }) ``` ### Technical Analysis The example reads an authentication token from the server-side cookie store and serializes the cookie object into a JSON response. If the cookie is marked `HttpOnly`, returning its value through an API response defeats that protection by making the credential available to client-side JavaScript and other response consumers. The response may also be captured by browser extensions, application telemetry, reverse-proxy logs, debugging tools, monitoring systems, or improperly configured caches. Applications that adopt this example with real session credentials could therefore disclose reusable authentication material. Although this is documentation rather than an automatically executed handler, it presents an insecure implementation pattern that developers may copy into production applications. ### Attack Path 1. A developer implements the documented request-helper example using a real authentication cookie. 2. An authenticated user requests the affected route handler. 3. The server reads the user's token from the cookie store. 4. The handler includes the token in its JSON response. 5. Malicious client-side code, a compromised browser extension, logging infrastructure, or another party able to observe the response obtains the token. 6. If the token is reusable, the attacker submits it to authenticated endpoints and impersonates the victim. ### Impact Assessment An attacker who obtains a reusable session token may gain the same application privileges as the affected user. Depending on the victim account, this could allow access to private data, modification of account resources, or administrative operations. The scop ...[truncated 217 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never include authentication tokens, session identifiers, authorization headers, or complete cookie objects in API responses. - Use the token exclusively on the server to authenticate the request. - Return only the minimum non-sensitive information required by the client, such as an authenticated Boolean or a sanitized user profile. - Explicitly document that `HttpOnly` credentials must not be copied into client-readable responses. - Add authorization checks before returning protected data. - Apply restrictive cache controls to authenticated responses, for example: ```tsx export async function GET(request: Request) { const cookieStore = await cookies() const token = cookieStore.get('token')?.value const user = token ? await validateSession(token) : null if (!user) { return Response.json( { error: 'Unauthorized' }, { status: 401, headers: { 'Cache-Control': 'no-store' }, }, ) } return Response.json( { query: new URL(request.url).searchParams.get('q'), user: { id: user.id, name: user.name, }, }, { headers: { 'Cache-Control': 'private, no-store' }, }, ) } ``` ]]>