[Security] Guest token rides in URL query string - leaks via access logs / history / Referer #21

New issue

Open

opened 2026-06-22 11:11:51 +00:00 by hermes · 0 comments

hermes commented

2026-06-22 11:11:51 +00:00

Collaborator

Context

Identified during advisory review of #17 (guest checkout).

Problem

On the payment page the guest token (the customer's only credential) is passed as ?token=.... Query strings land in:

Browser history
nginx / reverse proxy access logs
Potential Referer leakage (mitigated if strict-origin-when-cross-origin policy holds, but that is implicit, not enforced in code)

The magic-link landing /gast-order/:token is inherently URL-based (accepted Notion/Stripe pattern), but the payment page does not have to expose the token in a query string.

Severity

Warning

Suggested fix

Prefer sessionStorage / a Pinia store / route state (or at minimum the URL fragment, #token=..., which is not logged) for the payment page.
Consider nulling guest_token once the order reaches a terminal state (sent / delivered / cancelled) so stale magic links stop working.
Ensure access logs for /gast-order/:token are rotated normally.

References

PR: #17

## Context Identified during advisory review of #17 (guest checkout). ## Problem On the payment page the guest token (the customer's *only* credential) is passed as `?token=...`. Query strings land in: - Browser history - nginx / reverse proxy access logs - Potential `Referer` leakage (mitigated if `strict-origin-when-cross-origin` policy holds, but that is implicit, not enforced in code) The magic-link landing `/gast-order/:token` is inherently URL-based (accepted Notion/Stripe pattern), but the *payment* page does not have to expose the token in a query string. ## Severity Warning ## Suggested fix - Prefer `sessionStorage` / a Pinia store / route state (or at minimum the URL fragment, `#token=...`, which is not logged) for the payment page. - Consider nulling `guest_token` once the order reaches a terminal state (`sent` / `delivered` / `cancelled`) so stale magic links stop working. - Ensure access logs for `/gast-order/:token` are rotated normally. ## References - PR: https://srvr.nu/git/jocke/bilhej/pulls/17