MCP/API setup copies force `http://` base URLs that embed personal Bearer tokens

未关闭 适合新手
  • 哪里不对？
#94 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@Robert0622 已经在做这个了。

开始于 2026年11月9日。

  • #132 来自 @Robert0622 —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
75/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
go, javascript
领域
api, authentication, security

调研方向

从 web/app/access.js 中的 getPublicBaseURL() 和包含令牌的 MCP 与 REST 模板开始；web/app.js 提供主机名，而 internal/httpapi/studio.go 会注入它。阅读部署 HTTPS 反向代理指南，并追踪页面的 scheme 如何传递到复制的 URL 中。完成标准是：安全部署生成的每个含令牌的设置 URL 都使用 HTTPS，并且有一项针对性测试覆盖 scheme 的选择。

由索引模型根据 Issue 内容生成。

描述

Summary

Access / MCP onboarding builds public base URLs with a hard-coded http:// scheme and interpolates the user’s newly created personal Bearer token into MCP JSON, curl samples, and one-click agent prompts. On deployments that terminate TLS at a reverse proxy while the studio page is reached over HTTPS, following those copied instructions sends long-lived API/MCP tokens in cleartext over HTTP.

Affected code (head c7114fca)

Location What the code does
web/app/access.js getPublicBaseURL() always returns 'http://' + domain — no location.protocol, no HTTPS branch
web/app/access.js Module-level PUBLIC_BASE_URL likewise prefixes http://
web/app/access.js accessMcpClientSpec / accessMcpAgentPrompt embed base + Bearer ${token}
web/app/access.js REST setup: AGENTFLOW_URL=${base} and curl with Bearer token
web/app/access.js MCP tab: same base + token in prompt, manual mcp.json, and curl tools/list
web/app/access.js Token reveal: MCP client spec / agent prompt rebuilt with getPublicBaseURL() + revealed token
web/app.js Domain from <meta name="agentflow-app-domain"> (hostname, no scheme)
internal/httpapi/studio.go stampStudioIndex injects AGENTFLOW_APP_DOMAIN / APP_DOMAIN as meta content (raw domain string)
docs/deployment.md Documents HTTPS reverse proxy in front of the service; AGENTFLOW_SECURE_COOKIES=true when HTTPS terminates at the proxy
.env.example Notes production HTTPS → AGENTFLOW_SECURE_COOKIES=true
Contrast Runner bind copy prefers HTTPS first (deploy/bind-cli.sh); preview UI has HTTPS upgrade helpers in runs.js — Access onboarding does not

Conditions

  1. User is logged in, opens Access (MCP / REST / Token reveal), and creates or reveals a personal token (state.revealedToken).
  2. UI copies snippets that set AGENTFLOW_URL=http://<domain> (or MCP url / curl URL) and Authorization: Bearer <token> using getPublicBaseURL().
  3. Deployment serves the studio over HTTPS at the edge while AGENTFLOW_APP_DOMAIN / APP_DOMAIN is a bare hostname (common TLS-terminated proxy layout per deployment docs). Backend may still speak HTTP to the proxy; that alone is fine — the issue is client instructions that force HTTP for token-bearing calls.
  4. User (or an agent following the pasted prompt) executes the copied HTTP endpoint.

No special attacker role is required beyond the victim following their own Access copy flow (self-inflicted cleartext token transport). Risk materializes when those instructions leave the HTTPS studio context (local agent, curl on another host, MCP client config).

User copy / follow steps (expected misuse path — not captured)

  1. Open Access → MCP (or REST / create Token).
  2. Create token / use “生成并复制” so the prompt or mcp.json contains a real Bearer token.
  3. Observe generated base: always http:// + domain (static reading of getPublicBaseURL; no location.protocol).
  4. Paste into Cursor/Claude/CodeBuddy/Codex or run the curl sample → client contacts http://… with the Bearer token.

Not claimed: MitM observed on a wire, or that every deployment is HTTPS. Claim is: templates force HTTP, which is unsafe whenever the public entry is HTTPS / TLS-terminated.

Impact

  • Cleartext exposure of long-lived personal API/MCP tokens on the path between client and the HTTP origin named in the snippet (MitM, captive portals, corporate proxies).
  • Automated agents that follow the prompt will prefer the insecure endpoint.
  • Mixed-content / confusing breakage is secondary; the security issue is token transport scheme.

Suggested fix

  1. Derive scheme from window.location.protocol, or from a config/meta that may include https:// (e.g. align with LOOPFORGE_PUBLIC_URL / public URL scheme).
  2. Never downgrade an HTTPS studio page to http:// for token-bearing endpoints.
  3. Align Access/MCP copy with runner install guidance that already prefers HTTPS.
  4. Add a unit/UI test that locks scheme selection for token-bearing templates (HTTPS page must not emit http:// bases).

Acceptance criteria

  • Token-bearing setup URLs use HTTPS whenever the studio page or configured public base is HTTPS.
  • No Access/MCP generated snippet forces http:// for a secure deployment.
  • Focused test locks scheme selection for token templates.
  • Issue text does not claim a packet capture unless one is separately recorded.
主要语言
Go
星标
141
派生
28
平均合并
2 天 15 小时
30 天内合并 PR
41

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

Tencent/LoopForge 的其他 Issue

查看 Tencent/LoopForge 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。