Description

This detector identifies hardcoded sensitive values assigned to security-critical HTTP headers in C# code. It inspects both method invocations (e.g., `headers.Add(...)`) and indexer-style assignments (e.g., `headers["Authorization"] = "..."`) to detect cases where sensitive headers receive literal, hardcoded credential values instead of dynamic or securely-retrieved ones. Hardcoding credentials in headers poses a significant security risk as it exposes secrets directly in source code.

Detection Strategy

• Identify all candidate expressions in the code that either call a method to add/set an HTTP header (invocation style) or use bracket-notation indexer assignment to set an HTTP header.

• Extract the header name from the first argument of the matched expression. Flag the expression only if the header name corresponds to a known sensitive header (e.g., 'Authorization', 'X-Api-Key', 'X-Auth-Token', or similar security-critical headers).

• Inspect the second argument (the header value) to determine whether it is a hardcoded literal string or constant. If the value is a compile-time literal/constant rather than a variable, secret-store reference, or environment variable, the expression is considered vulnerable.

• A vulnerability is reported when all three conditions are met simultaneously: (1) the expression sets an HTTP header via invocation or indexer syntax, (2) the header name matches a sensitive/security-critical header, and (3) the assigned value is a hardcoded credential literal.

Vulnerable code example

using System.Net;
using System.Net.Http;
using Microsoft.Extensions.DependencyInjection;

public class Example
{
    private const string ApiKey = "pk_live_9f3kd02mzq81xbn4"; // hardcoded secret in const
...

✅ Secure code example

using System;
using System.Net;
using System.Net.Http;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;

public class Example
{...