bypass_csp cookies are passed through the URL query string instead of looked up server-side #6

New issue

Closed

opened 2026-07-28 21:01:38 +00:00 by paulloth1 · 1 comment

paulloth1 commented

2026-07-28 21:01:38 +00:00

(Migrated from github.com)

Problem

backend/slides/media.py builds the iframe src for bypass_csp slides as /proxy?url=<...>&cookies=<raw cookie header, urlencoded>. The cookie value (already stored server-side in the slide's config) ends up embedded in a URL that:

appears in the rendered HTML/DOM (visible via devtools on the display, low risk since it's a closed kiosk),
gets logged by any HTTP access log on the backend (uvicorn access logs, if enabled, or any reverse proxy in front of it) in plaintext, including query strings,
is redundant: the backend already has the slide's config (and thus the cookie value) in the DB, keyed by slide id.

Suggested fix

Have /proxy accept a slide_id instead of raw url/cookies params, and look up the target URL + stored cookies server-side from db.get_slide(slide_id)["config"]. This avoids duplicating/leaking the cookie value into the URL entirely.

## Problem `backend/slides/media.py` builds the iframe `src` for `bypass_csp` slides as `/proxy?url=<...>&cookies=<raw cookie header, urlencoded>`. The cookie value (already stored server-side in the slide's `config`) ends up embedded in a URL that: - appears in the rendered HTML/DOM (visible via devtools on the display, low risk since it's a closed kiosk), - gets logged by any HTTP access log on the backend (uvicorn access logs, if enabled, or any reverse proxy in front of it) in plaintext, including query strings, - is redundant: the backend already has the slide's `config` (and thus the cookie value) in the DB, keyed by slide id. ## Suggested fix Have `/proxy` accept a `slide_id` instead of raw `url`/`cookies` params, and look up the target URL + stored cookies server-side from `db.get_slide(slide_id)["config"]`. This avoids duplicating/leaking the cookie value into the URL entirely.

paulloth1 commented

2026-07-28 21:22:58 +00:00

(Migrated from github.com)

Fixed in a841b02 (merged to main at 103cdf2): /proxy now accepts an optional slide_id param and looks up url/cookies server-side from the stored slide config when given. media.py's render() now builds /proxy?slide_id={id} instead of embedding the cookie value in the query string. The old url/cookies params still work directly for backward compatibility.

Fixed in a841b02 (merged to main at 103cdf2): /proxy now accepts an optional slide_id param and looks up url/cookies server-side from the stored slide config when given. media.py's render() now builds /proxy?slide_id={id} instead of embedding the cookie value in the query string. The old url/cookies params still work directly for backward compatibility.