Dimillian / Dimillian/IceCubesApp
Bug:Sends access token via Sec-Websocket-Protocol
Nobody has claimed this yet.
- Dominant language
- Swift
- Stars
- 7.1k
- Forks
- 720
- PR merge metrics
- No merged PRs in 30d
Description
Environment:
- OS: iPadOS 18.1.1
- IceCubesApp version: 1.11.2
Description
Ice Cubes sends the access token for the streaming API via the Sec-Websocket-Protocol header. The Mastodon documentation of the streaming API does not document this way of use. And this header is not considered sensitive, so often logged.
The documented way to do auth against the streaming API is to use the access_token query parameter.
The standard Authorization header is implemented as well for the streaming API, but not documented.
Related Issues
- Search that this bugs don't already exist before creating it.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Search the Swift code that creates the Mastodon streaming WebSocket connection and supplies the access token. Compare its authentication handling with the documented access_token query parameter and the standard Authorization header. Done means the token is no longer sent through Sec-Websocket-Protocol and streaming authentication still works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- api, mobile, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100