Quota HTTP client follows redirects while holding provider credentials
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 94
- Forks
- 16
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 5
Description
Summary
quota_http_json() in token_meter/quotas/common.py uses stdlib urlopen, which follows redirects.
Claude sends Authorization: Bearer <oauth access token>. Cursor sends Cookie: WorkosCursorSessionToken=…. Codex OAuth sends a bearer token to chatgpt.com.
Python 3.11+ strips Authorization on cross-host redirects. It does not strip Cookie. Older Python may forward Authorization as well.
Endpoints are fixed today (api.anthropic.com, chatgpt.com, cursor.com), so this is not open SSRF. It is still “if the provider (or a future URL change) 302s, credentials leave the intended host.”
Error handling here is otherwise careful (size cap, sanitized QuotaUnavailable messages, tests in tests/contracts/test_quota_privacy.py).
Suggested fix
Use an opener whose redirect handler refuses to follow, and fail closed. Optionally pin the final URL.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in token_meter/quotas/common.py at quota_http_json() and review the existing privacy coverage in tests/contracts/test_quota_privacy.py. Run those tests first, then add coverage showing redirects are refused and provider credentials do not leave the intended host. Done means redirect handling fails closed without exposing Authorization or Cookie headers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100