T09 · Insecure Skill Coding Practices
- Location
SKILL.md:67- Finding
AppSecret and Login Code Exposed Through URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:67-69
Vulnerability Type: Sensitive credentials in a URL query string and unsafe query construction
Risk Level: Mediumjavascript // 2. code2Session 校验登录 const loginRes = await fetch( `https://minigame.zijieapi.com/mgplatform/api/apps/jscode2session?appid=ttxxx&secret=xxx&code=${code}` );Technical Analysis
The example places the application's AppSecret and a one-time login code directly in the request URL. Although the request uses HTTPS, query strings may be recorded by reverse proxies, API gateways, application servers, APM products, tracing platforms, exception reports, or request-history tools. HTTPS only protects the request in transit and does not prevent endpoint URLs from being logged.
The example also interpolates
codedirectly into the query string without URL encoding. A value containing reserved characters such as&,=,#, or?can alter the request structure, produce malformed requests, or inject additional query parameters.The network request itself is consistent with the Skill's declared purpose: exchanging Douyin mini-game login credentials with the documented platform endpoint. The issue is therefore not unauthorized network transmission, but insecure handling of credentials within that necessary request.
Attack Path
- A developer copies the documented example into a backend service.
- The backend sends the AppSecret and login code in the request URL.
- A reverse proxy, APM agent, tracing platform, application logger, or error-reporting service records the complete URL.
- An attacker or lower-privileged operator with access to those logs retrieves the AppSecret.
- The attacker uses the AppSecret and AppID to request application access tokens from the documented token endpoint.
- Subject to the application's platform permissions, the attacker invokes Douyin mini-game server APIs as the affected application. A captured login code ...[truncated 793 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer the official SDK or a platform-supported method that transmits credentials in an HTTPS request body or authorization header.
- If the platform requires
code2Sessionto use GET query parameters:- Construct the URL with
URLandURLSearchParamsrather than string interpolation. - Redact
secret,code,anonymous_code,access_token,session_key, andsignaturefrom logs, traces, metrics, and error reports. - Disable query-string logging for the endpoint at proxies, gateways, load balancers, and application middleware.
- Restrict access to operational logs and minimize their retention period.
- Construct the URL with
- Load the AppSecret from a managed secret store or protected server environment variable rather than embedding it in source code.
- Never return AppSecret, access tokens, or session keys to clients.
- Rotate the AppSecret and invalidate affected tokens if URL or telemetry exposure is suspected.
- Use encoded query construction, for example:
javascript const url = new URL( 'https://minigame.zijieapi.com/mgplatform/api/apps/jscode2session' ); url.search = new URLSearchParams({ appid: process.env.DOUYIN_APP_ID, secret: process.env.DOUYIN_APP_SECRET, code }).toString(); const loginRes = await fetch(url, { headers: { accept: 'application/json' } });