MEDIUM: API key transmitted as URL query parameter instead of HTTP header #3

New issue

Closed

opened 2026-05-09 05:09:47 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 05:09:47 +00:00

Owner

Severity: MEDIUM

Location

tokengenerator.html, lines 287 and 338:

const apiUrl = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-preview-05-20:generateContent?key=${apiKey}`;
const apiUrl = `https://generativelanguage.googleapis.com/v1beta/models/imagen-3.0-generate-002:predict?key=${apiKey}`;

Description

The API key is appended as a query parameter (?key=...) in the URL. This is less secure than using the X-Goog-Api-Key HTTP header because:

URL logging: URLs are commonly logged by proxies, load balancers, and analytics services. The API key would be logged in plaintext.
Referrer leakage: The URL (with the key) may be sent as the Referer header to other services.
Caching: Some CDN/proxy caches may cache URLs including query parameters.

Recommended Fix

Use the X-Goog-Api-Key header instead: headers: { "X-Goog-Api-Key": apiKey }
This keeps the key out of server logs and URLs.

Impact

Reduced security posture for credential handling.

## Severity: MEDIUM ## Location `tokengenerator.html`, lines 287 and 338: ```javascript const apiUrl = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-preview-05-20:generateContent?key=${apiKey}`; const apiUrl = `https://generativelanguage.googleapis.com/v1beta/models/imagen-3.0-generate-002:predict?key=${apiKey}`; ``` ## Description The API key is appended as a query parameter (`?key=...`) in the URL. This is less secure than using the `X-Goog-Api-Key` HTTP header because: 1. **URL logging**: URLs are commonly logged by proxies, load balancers, and analytics services. The API key would be logged in plaintext. 2. **Referrer leakage**: The URL (with the key) may be sent as the Referer header to other services. 3. **Caching**: Some CDN/proxy caches may cache URLs including query parameters. ### Recommended Fix - Use the `X-Goog-Api-Key` header instead: `headers: { "X-Goog-Api-Key": apiKey }` - This keeps the key out of server logs and URLs. ### Impact Reduced security posture for credential handling.