Fix security vulnerabilities and improve authentication methods - #1
Draft
DirectorVector wants to merge 7 commits into
Draft
Fix security vulnerabilities and improve authentication methods#1DirectorVector wants to merge 7 commits into
DirectorVector wants to merge 7 commits into
Conversation
…d SSRF Co-authored-by: DirectorVector <6549973+DirectorVector@users.noreply.github.com>
…ulnerabilities Fix security vulnerabilities: credential exposure, STDIO corruption, and SSRF
…based auth tool, remove Bearer prefix - Remove insecure path-based auth tool that leaked credentials in URL path - Update header-based auth tool to be the primary syteline_get_security_token - Remove Bearer prefix from Authorization header (use raw token per docs) - Use DEFAULT_SITE env var for config selection (default: Demo_DALS) - Update .env.example with DEFAULT_SITE - Update all documentation (README, AUTHENTICATION_GUIDE, ENVIRONMENT_SETUP, LLM_USAGE_INSTRUCTIONS, IDO_IMPLEMENTATION_VERIFICATION, ReferenceDocs) Co-authored-by: DirectorVector <6549973+DirectorVector@users.noreply.github.com>
Co-authored-by: DirectorVector <6549973+DirectorVector@users.noreply.github.com>
…rd-leak Fix credential leak: switch to header-based auth, remove path-based token endpoint
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hey Jason! Thanks for sharing your code with me during the .NET Extension Classes session at the SUN Conference! I sat in front of you and we chatted a bit after the session.
I've been working on my own set of docs that teach agents "how to fish" in Syteline using the REST api in DirectorVector/syteline-ido-api-agent-docs. Its currently able to resolve abstract prompts to a set of Syteline API calls that load collections, invoke ido methods, and the best part for my current use case is for Submitting Background Tasks.
Eventually I'll refine docs on updating/inserting/deleting data but for now I was happy with publishing. And of course the next step is to start thinking MCP, which is why your repo piqued my interest! But the first thing copilot identified using the context of my docs is the logging of the token url. So this PR addresses that, but I'd love for you to look it over, test it on your environment to make sure it works.
For reference, my environment, and the docs I generated for Syteline using my env, were performed using the IdoRequestService aka REST v2 with request sending straight to syteline.
The main differences I notice that may make this not work for you if your repo is currently working:
bearer $tokenin the Authorization header for subsequent requests. Mine has only worked when omitting the wordbearerand only passing the token to the header.Cheers!
Brice