MCP/API setup copies force `http://` base URLs that embed personal Bearer tokens

Ouverte Adaptée aux débutants
  • Quelque chose ne va pas ?
#94 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@Robert0622 y travaille déjà.

Depuis le 9/11/2026.

  • #132 par @Robert0622 — ouverte

Évaluation

Difficulté
2/5
Temps estimé
1-3 heures
Accessibilité débutants
75/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
go, javascript
Domaine
api, authentication, security

Piste de recherche

Commencez dans web/app/access.js, au niveau de getPublicBaseURL() et des modèles MCP et REST contenant des jetons ; web/app.js fournit le nom d’hôte, tandis que internal/httpapi/studio.go l’injecte. Lisez les instructions sur le proxy inverse HTTPS pour le déploiement et suivez le cheminement du schéma de la page jusqu’aux URL copiées. Le travail est terminé lorsque les déploiements sécurisés génèrent des URL HTTPS dans toutes les URL de configuration contenant un jeton et qu’un test ciblé couvre la sélection du schéma.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Summary

Access / MCP onboarding builds public base URLs with a hard-coded http:// scheme and interpolates the user’s newly created personal Bearer token into MCP JSON, curl samples, and one-click agent prompts. On deployments that terminate TLS at a reverse proxy while the studio page is reached over HTTPS, following those copied instructions sends long-lived API/MCP tokens in cleartext over HTTP.

Affected code (head c7114fca)

Location What the code does
web/app/access.js getPublicBaseURL() always returns 'http://' + domain — no location.protocol, no HTTPS branch
web/app/access.js Module-level PUBLIC_BASE_URL likewise prefixes http://
web/app/access.js accessMcpClientSpec / accessMcpAgentPrompt embed base + Bearer ${token}
web/app/access.js REST setup: AGENTFLOW_URL=${base} and curl with Bearer token
web/app/access.js MCP tab: same base + token in prompt, manual mcp.json, and curl tools/list
web/app/access.js Token reveal: MCP client spec / agent prompt rebuilt with getPublicBaseURL() + revealed token
web/app.js Domain from <meta name="agentflow-app-domain"> (hostname, no scheme)
internal/httpapi/studio.go stampStudioIndex injects AGENTFLOW_APP_DOMAIN / APP_DOMAIN as meta content (raw domain string)
docs/deployment.md Documents HTTPS reverse proxy in front of the service; AGENTFLOW_SECURE_COOKIES=true when HTTPS terminates at the proxy
.env.example Notes production HTTPS → AGENTFLOW_SECURE_COOKIES=true
Contrast Runner bind copy prefers HTTPS first (deploy/bind-cli.sh); preview UI has HTTPS upgrade helpers in runs.js — Access onboarding does not

Conditions

  1. User is logged in, opens Access (MCP / REST / Token reveal), and creates or reveals a personal token (state.revealedToken).
  2. UI copies snippets that set AGENTFLOW_URL=http://<domain> (or MCP url / curl URL) and Authorization: Bearer <token> using getPublicBaseURL().
  3. Deployment serves the studio over HTTPS at the edge while AGENTFLOW_APP_DOMAIN / APP_DOMAIN is a bare hostname (common TLS-terminated proxy layout per deployment docs). Backend may still speak HTTP to the proxy; that alone is fine — the issue is client instructions that force HTTP for token-bearing calls.
  4. User (or an agent following the pasted prompt) executes the copied HTTP endpoint.

No special attacker role is required beyond the victim following their own Access copy flow (self-inflicted cleartext token transport). Risk materializes when those instructions leave the HTTPS studio context (local agent, curl on another host, MCP client config).

User copy / follow steps (expected misuse path — not captured)

  1. Open Access → MCP (or REST / create Token).
  2. Create token / use “生成并复制” so the prompt or mcp.json contains a real Bearer token.
  3. Observe generated base: always http:// + domain (static reading of getPublicBaseURL; no location.protocol).
  4. Paste into Cursor/Claude/CodeBuddy/Codex or run the curl sample → client contacts http://… with the Bearer token.

Not claimed: MitM observed on a wire, or that every deployment is HTTPS. Claim is: templates force HTTP, which is unsafe whenever the public entry is HTTPS / TLS-terminated.

Impact

  • Cleartext exposure of long-lived personal API/MCP tokens on the path between client and the HTTP origin named in the snippet (MitM, captive portals, corporate proxies).
  • Automated agents that follow the prompt will prefer the insecure endpoint.
  • Mixed-content / confusing breakage is secondary; the security issue is token transport scheme.

Suggested fix

  1. Derive scheme from window.location.protocol, or from a config/meta that may include https:// (e.g. align with LOOPFORGE_PUBLIC_URL / public URL scheme).
  2. Never downgrade an HTTPS studio page to http:// for token-bearing endpoints.
  3. Align Access/MCP copy with runner install guidance that already prefers HTTPS.
  4. Add a unit/UI test that locks scheme selection for token-bearing templates (HTTPS page must not emit http:// bases).

Acceptance criteria

  • Token-bearing setup URLs use HTTPS whenever the studio page or configured public base is HTTPS.
  • No Access/MCP generated snippet forces http:// for a secure deployment.
  • Focused test locks scheme selection for token templates.
  • Issue text does not claim a packet capture unless one is separately recorded.
Langage dominant
Go
Étoiles
141
Forks
28
Merge moyen
2 j 15 h
PR mergées (30 j)
41

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de Tencent/LoopForge

Toutes les issues de Tencent/LoopForge

Issues similaires

Plus d'issues Go

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.