API key accepted in URL query parameters

Description

API keys can be passed via query parameters, which exposes them in server access logs, browser history, referrer headers, and shared URLs.

Files affected

• src/app/api/utils/apiKeyAuth.js

Current code

const url = new URL(req.url);
const queryApiKey = url.searchParams.get("apiKey");
if (queryApiKey) {
  return queryApiKey;
}

Recommended fix

Remove query parameter support entirely and only accept headers.