Token exposed in oAuth2 Call?

Questions
1

In security dashboard, Auth2CustomToken field says the token is exposed in client side . Is that true? I checked some network requests and always shows as doapicallservers but only parameters I sent to that request.

2

This depend on how you set things.
Dynamic parameters are sent to the backend WF with the doapicallservers and are available client side before this. If you have set private for your parameters, they are not sent client side. If thereā€™s private data sent in dynamic parameters, this should be protected by privacy rules to only allow access to this data to the owner of this data.

A good example where this is important is when you dynamically set the auth token like ā€œCurrent userā€™s tokenā€. This is available client side. BUT, if you have set privacy rules correctly, this should only be available to the owner of this token. So thereā€™s no security issue.

If you need to use ā€œon behalfā€ user token to access API data (user A need to access data from user B api) and you are dynamically setting this token, you should use a backend WF to keep this secure at this moment.

3

But how you set them as private? I canā€™t in my collection.

image
image1446Ɨ522 22.7 KB

4

If you use custom token oauth2, this will be added by Bubble automatically and you donā€™t need to set anything. This will be done on server side only and nothing on client side for this kind of auth

5

Also, in addition to @Jici , here are some things we should always check when using Keys. Someone can correct me if Iā€™m wrong. @Jici might have already said this too. :blush:

  1. Check that the API call is not a GET, I think it gets exposed this way.

  2. Also, in the API Connector, if itā€™s not private, make sure to remove it from their to ā€˜sanitizeā€™ it so itā€™s not exposed.

  3. Sometimes there is an issue with the wrong API key in the wrong place.

Also, i donā€™t normally set up calls with OAuth2 Custom Token. I handle them via ā€˜none or self-handledā€™ then check the privacy myself.

6

When you say is handled automatically you mean, all parameters are set as private by default?

7

The request is a login using POST. Iā€™m not using the calls, but the collection.

8

it doesnā€™t hange anything if this is a GET or a POST

Agree

Itā€™s more than that, the call to get the token is done on server side first and added to API call as authorization header also on server side. So everything is done on server side and this way, they are private.

9

Maybe not in this situation, but for some reason there were warnings in the Security Dashboard when I had some API calls as a GET instead of a POST. :man_shrugging: You are probably right though @Jici. :blush:

10

Yes, security Dashboard often mention some possible security issue, and more often I think with GET but in most case, they are not true. But everything from security dashboard should be checked to validate thereā€™s no issue.

11

I think the security dashboard flags wrong the calls under the oAuth2Custom token too, because it says the urls should be private, but checking requests they are protected the same as the request to login and use the collection, only parameters are shown. @Jici Thanks for the help @J805

12

If something is being flagged wrong, you can let Bubble support know so they can improve the security dashboard. :blush:

13

I forget that one case linked to ā€œDATAā€ settings with none or oauth2 user agent flow can have an issue by bypassing privacy rules (but itā€™s not related to GET, but to DATA type). In most case, this is not an issue but if you are calling an API with your own API key and not using header but parameters this could be an issue.

14

That makes sense. Thatā€™s probably what it was. :blush:

15

The Auth2CustomToken being flagged in the security dashboard usually just means the token is accessible client-side via Bubbleā€™s state/data exposure ā€” not necessarily that itā€™s visible in network requests. Since youā€™re seeing doApiCallServer in the network tab, the actual API call is server-side, which is good.

The flag is more about whether the token value could be read from the page state or returned data. A few things worth checking:

  1. Is the token stored in a field on a data type thatā€™s exposed to the client (e.g., in the current userā€™s record)?
  2. Are you returning the token value anywhere in a response that gets displayed or stored client-side?

If the token only lives server-side and youā€™re never surfacing it in the UI or a client-accessible field, youā€™re likely fine despite the warning. What data type/field is Auth2CustomToken stored on?

16

  1. No token, the token is protected in the API call.

  2. Tokens do not return to the frontend as I can see.

    A different quest: about the parameters, I can change then if are sent using the Get External Data API? Like intercepting it and changing a parameter like ā€˜company_productā€™? I tried doing that, but doing this only returned the values using the parameter set before for that, from the user.

    I thought frontend parameters could be change in any kind of call but I always receive the same payload

@letsbuidmyapp