Description

openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

Summary

Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.

Affected Code

# openssl_encrypt_server/modules/telemetry/routes.py:90-91
async def refresh_token(
    request: Request,
    refresh_token: str = Query(..., description="Refresh token")
):

Impact

Tokens in URL query parameters are exposed in:

Server access logs

Proxy/CDN logs

Browser history

HTTP Referer headers

Network monitoring tools

This creates significant token leakage risk.

Recommended Fix

Accept refresh tokens in the request body (POST) instead of query parameters

Use Body(...) instead of Query(...)

Fix

Fixed in commit 4b2adb0 on branch releases/1.4.x — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.

Mitigation

Aliases

References