Cybersecurity issue: CWE-798 hard-coded authentication in web client side

Report a Bug
1

Team ID:

https://go.glideapps.com/o/lxYiTW2xZd5JdolIXarV/

App ID:

https://go.glideapps.com/app/TusQVIs3ZvE7aC2eR6ws/layout

Description

As our client requested, we ran an source code security analysis report, targeting the source code from web-client side.

The result shows that there’s a risk called “Credential Management: Hardcoded API Credentials”, type “CWE-798”, which is leveled as Critical risk.

I wonder if the team could fix it soon? As client asking that if this should be worried about.

How to replicate

  1. Open any of your Glide App web-client page.
  2. Navigate to the Sources. For example, in Google Chrome, open DevTools > Sources.
  3. Navigate to the code of sw-prod-v4.js > your-app-name.glide.page > static/js > sw-common-alotoftokens.js
  4. Search keywords in the code, ex. apiKey: appId

You will find some keys / auth tokens are hard-coded in that script, like this:

1454×752 126 KB

I took a quick look to other website services like WordPress, wix, Google, Facebook, etc. It seems that the hard-coded authentication does not exist in their web service.

2

The API key is probably an ANON key.

@NoCodeAndy Am I right?

1 Like