Issue ouverte · Issue #1017 Access tokens are sent in the introspection URL, so they end up in access logs · @rmdes
introspectToken in packages/indiekit/lib/token.js sends the token being checked in the URL as well as in the Authorization header:
introspectionUrl.searchParams.append(“token”, bearerToken);
The introspection endpoint never reads it from there (it reads request.body.token, then the header), so the URL copy does nothing but leak a long-lived access token into access logs, and into any proxy or external IndieAuth server’s logs on the way. On a deployment every Micropub request without a session leaves a line like:
POST /auth/introspect?token=eyJhbGciOiJIUzI1NiIs… HTTP/1.1
RFC 7662 §2.1 has the client send the token as a form-encoded token parameter in the POST body.
Related to #1006.