🔐 Avoid exposing access token in URL query parameters

[0GiS0]

🔍 Security Issue

In views/device-code.ejs (line 73), the access token is passed as a URL query parameter:

window.location.replace(`http://localhost:8000/access/token/?access_token=${access_token}`);

This practice has several security implications:

🚨 Risks:

1. Browser History - Access tokens are stored in browser history, making them accessible to anyone with physical access to the device
2. Referer Headers - If the page makes external requests, the token could leak via HTTP Referer headers
3. Logs - Tokens appear in server access logs, CDN logs, and analytics tools
4. Bookmarks - Users might accidentally bookmark a URL containing the token
5. Shoulder Surfing - Tokens are visible in the browser address bar

💡 Proposed Solution

Option 1: Use POST with Form Data (Recommended)

Instead of redirecting with query parameters, submit the token via POST:

// In device-code.ejs
const form = document.createElement("form");
form.method = "POST";
form.action = "/access/token";

const input = document.createElement("input");
input.type = "hidden";
input.name = "access_token";
input.value = access_token;
form.appendChild(input);

document.body.appendChild(form);
form.submit();

Option 2: Use Session Storage

Store the token in sessionStorage and retrieve it on the next page:

// In device-code.ejs
sessionStorage.setItem("access_token", access_token);
window.location.replace("/access/token");

// In access-token.ejs
const token = sessionStorage.getItem("access_token");
sessionStorage.removeItem("access_token");

Option 3: Server-Side Session

Store the token in a server-side session and retrieve it on the next page (most secure).

🎯 Benefits

• Improved Security - Tokens are not exposed in URLs
• Better Privacy - No token leakage through logs or history
• Best Practices - Aligns with OAuth 2.0 security recommendations
• Educational Value - Demonstrates secure token handling for learners

📚 References

• OAuth 2.0 Security Best Current Practice
• OWASP - Session Management Cheat Sheet

---

This discussion was automatically generated by Copilot CLI