Liner
Is this something to actually worry about? (i used ai so im sorry if its nothing) #82
Replies: 2 comments 4 replies
|
Thanks for flagging this! The finding is valid: if the HTTPS health check fails, the client can fall back to the plain HTTP endpoint, and the refresh token is then sent unencrypted. This is addressed in #85, which removes the HTTP fallback so authenticated requests only go over HTTPS. It is pending review. For future security findings, please use a private security advisory instead of a public discussion. |
|
Thanks, yea sorry for the public discussion, i don't use GitHub at all so i don't know alot how or what to do |
|
also question where do i exactly find and use private security advisory |
|
No worries, and thanks again for reporting it! To answer your question: private vulnerability reporting isn’t enabled on this repository yet, so there’s no private option right now. @feralbureau, could you turn it on in the repository settings? Once it’s on, there will be a “Report a vulnerability” button in the Security tab. It opens a draft advisory that only you and the maintainers can see. One correction on my earlier answer: the fallback is already disabled in main since #28 was merged, so the next release no longer falls back to plain HTTP. Version 0.1.35 still does. #85 removes the leftover code and makes the client refuse a non-HTTPS API address. |
|
Thanks you! i will be reporting couple small ones when it gets turned on. |
|
Sure ! |
Thanks for flagging this! The finding is valid: if the HTTPS health check fails, the client can fall back to the plain HTTP endpoint, and the refresh token is then sent unencrypted. This is addressed in #85, which removes the HTTP fallback so authenticated requests only go over HTTPS. It is pending review. For future security findings, please use a private security advisory instead of a public discussion.