PR Custody

fix: prevent CLI session code from leaking API keys

@kaavee315checks n/achecks…codex/propose-fix-for-cli-session-vulnerability → master2 files · +58 −34review: @sohamganatrareview: @anshugarg15updated 1w ago

GitHub

▸Description · 1 noise

Motivation

The unauthenticated GET /api/v3/cli/get-session accepted the short 6-character CLI code and returned plaintext api_key for linked sessions, allowing network attackers to brute-force the 24-bit code space and harvest API keys.
The fix must prevent credential disclosure via low-entropy codes while preserving normal polling by the CLI using the high-entropy UUID session identifier.

Description

Only return api_key when the caller supplies the full UUID session id; code-based lookups now always return api_key: null but still expose session status/account metadata to support UX flows.
Implemented the guard const canReturnApiKey = isUuid in apps/apollo/src/pages/api/v3/cli/get-session.ts and wrapped API-key resolution behind that check.
Added regression tests in apps/apollo/src/pages/api/v3/cli/cli_sessions.test.ts that assert code-based lookups do not return api_key for both project- and user-scoped linked sessions.

Testing

Ran the CLI session unit tests with pnpm test src/pages/api/v3/cli/cli_sessions.test.ts, and the test suite passed.
The new tests verify that UUID-based lookups still return api_key while code-based lookups return null, preventing short-code credential disclosure.

Codex Task

▸ 1 bot/status comment hidden

@github-actions[bot]1w ago

🔍 Suggested Reviewers

Based on git blame analysis of 2 file(s):

Contributor	Contribution	Files
haxzie	84%	2
Rahul Tarak	12%	2
Himanshu Dixit	3%	1
lingalarahul7	1%	1

💡 Recommendation

Based on git history, haxzie or Rahul Tarak would be good reviewer(s) for this PR.

🤖 Based on git blame with recency weighting (recent edits count more).

loading diff…