MCP/API setup copies force `http://` base URLs that embed personal Bearer tokens

Offen Anfängerfreundlich
  • Stimmt etwas nicht?
#94 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@Robert0622 arbeitet bereits daran.

Seit 09.11.2026.

  • #132 von @Robert0622 — offen

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
75/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
go, javascript
Bereich
api, authentication, security

Rechercherichtung

Beginne in web/app/access.js bei getPublicBaseURL() und den tokenhaltigen MCP- und REST-Vorlagen; web/app.js liefert den Hostnamen, während internal/httpapi/studio.go ihn einfügt. Lies die Hinweise zum HTTPS-Reverse-Proxy für die Bereitstellung und verfolge, wie das Schema der Seite in die kopierten URLs gelangt. Erledigt ist die Aufgabe, wenn sichere Bereitstellungen in jeder tokenhaltigen Einrichtungs-URL HTTPS ausgeben und ein gezielter Test die Schemaauswahl abdeckt.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Summary

Access / MCP onboarding builds public base URLs with a hard-coded http:// scheme and interpolates the user’s newly created personal Bearer token into MCP JSON, curl samples, and one-click agent prompts. On deployments that terminate TLS at a reverse proxy while the studio page is reached over HTTPS, following those copied instructions sends long-lived API/MCP tokens in cleartext over HTTP.

Affected code (head c7114fca)

Location What the code does
web/app/access.js getPublicBaseURL() always returns 'http://' + domain — no location.protocol, no HTTPS branch
web/app/access.js Module-level PUBLIC_BASE_URL likewise prefixes http://
web/app/access.js accessMcpClientSpec / accessMcpAgentPrompt embed base + Bearer ${token}
web/app/access.js REST setup: AGENTFLOW_URL=${base} and curl with Bearer token
web/app/access.js MCP tab: same base + token in prompt, manual mcp.json, and curl tools/list
web/app/access.js Token reveal: MCP client spec / agent prompt rebuilt with getPublicBaseURL() + revealed token
web/app.js Domain from <meta name="agentflow-app-domain"> (hostname, no scheme)
internal/httpapi/studio.go stampStudioIndex injects AGENTFLOW_APP_DOMAIN / APP_DOMAIN as meta content (raw domain string)
docs/deployment.md Documents HTTPS reverse proxy in front of the service; AGENTFLOW_SECURE_COOKIES=true when HTTPS terminates at the proxy
.env.example Notes production HTTPS → AGENTFLOW_SECURE_COOKIES=true
Contrast Runner bind copy prefers HTTPS first (deploy/bind-cli.sh); preview UI has HTTPS upgrade helpers in runs.js — Access onboarding does not

Conditions

  1. User is logged in, opens Access (MCP / REST / Token reveal), and creates or reveals a personal token (state.revealedToken).
  2. UI copies snippets that set AGENTFLOW_URL=http://<domain> (or MCP url / curl URL) and Authorization: Bearer <token> using getPublicBaseURL().
  3. Deployment serves the studio over HTTPS at the edge while AGENTFLOW_APP_DOMAIN / APP_DOMAIN is a bare hostname (common TLS-terminated proxy layout per deployment docs). Backend may still speak HTTP to the proxy; that alone is fine — the issue is client instructions that force HTTP for token-bearing calls.
  4. User (or an agent following the pasted prompt) executes the copied HTTP endpoint.

No special attacker role is required beyond the victim following their own Access copy flow (self-inflicted cleartext token transport). Risk materializes when those instructions leave the HTTPS studio context (local agent, curl on another host, MCP client config).

User copy / follow steps (expected misuse path — not captured)

  1. Open Access → MCP (or REST / create Token).
  2. Create token / use “生成并复制” so the prompt or mcp.json contains a real Bearer token.
  3. Observe generated base: always http:// + domain (static reading of getPublicBaseURL; no location.protocol).
  4. Paste into Cursor/Claude/CodeBuddy/Codex or run the curl sample → client contacts http://… with the Bearer token.

Not claimed: MitM observed on a wire, or that every deployment is HTTPS. Claim is: templates force HTTP, which is unsafe whenever the public entry is HTTPS / TLS-terminated.

Impact

  • Cleartext exposure of long-lived personal API/MCP tokens on the path between client and the HTTP origin named in the snippet (MitM, captive portals, corporate proxies).
  • Automated agents that follow the prompt will prefer the insecure endpoint.
  • Mixed-content / confusing breakage is secondary; the security issue is token transport scheme.

Suggested fix

  1. Derive scheme from window.location.protocol, or from a config/meta that may include https:// (e.g. align with LOOPFORGE_PUBLIC_URL / public URL scheme).
  2. Never downgrade an HTTPS studio page to http:// for token-bearing endpoints.
  3. Align Access/MCP copy with runner install guidance that already prefers HTTPS.
  4. Add a unit/UI test that locks scheme selection for token-bearing templates (HTTPS page must not emit http:// bases).

Acceptance criteria

  • Token-bearing setup URLs use HTTPS whenever the studio page or configured public base is HTTPS.
  • No Access/MCP generated snippet forces http:// for a secure deployment.
  • Focused test locks scheme selection for token templates.
  • Issue text does not claim a packet capture unless one is separately recorded.
Vorherrschende Sprache
Go
Sterne
141
Forks
28
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
41

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus Tencent/LoopForge

Alle Issues in Tencent/LoopForge

Ähnliche Issues

Weitere Issues zu Go

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.