API Key Exposed in URL

Detects API keys and tokens passed as URL query parameters, which are logged in server logs, browser history, and Referer headers.

zakirkun Updated

File contents

API Key Exposed in URL

Overview

API keys in URL query parameters appear in:

  • Server access logs (nginx, Apache, CloudFront)
  • Browser history
  • Referer headers sent to third-party analytics
  • Shared URLs (when users copy the URL from their browser)
  • Proxy logs and CDN access logs

Remediation

  • Pass API keys in HTTP headers: Authorization: Bearer <token> or X-API-Key: <key>
  • Never log or store full URLs with API keys
  • Rotate any keys that appeared in URLs

zakirkun/ice-tea/tree/main/skills/auth/api-key-in-url commit 095200378f

Frequently asked questions

npx skillmds@latest add zakirkun/api-key-exposed-in-url