Sensitive Data: Inline Authentication Header Leak in JavaScript Bundle¶

Identifier: js_data_leak_auth_header

Scanner(s) Support¶

Description¶

Inline Authorization, X-Api-Key, or X-Auth-Token values hardcoded in JavaScript request configuration expose API credentials to every user who can view the bundle. Authentication secrets must be injected server-side or obtained through a secure session flow, not embedded in client-side fetch or XHR code.

How we test: We statically analyze first-party JavaScript bundles for inline HTTP headers such as Authorization, X-Api-Key, or X-Auth-Token set to literal secret values.

References:

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• CWE-798: Use of Hard-coded Credentials
• OWASP API Security Top 10 2023: API8 Security Misconfiguration

Configuration¶

Example¶

Example configuration:

---
security_tests:
  js_data_leak_auth_header:
    issues_count_limit: 20
    skip: false

Reference¶

issues_count_limit¶

Type : integer

The maximum number of issues to report. Use 0 to report all issues.

skip¶

Type : boolean

Skip the test if true.