Route forwards POST data across API redirections

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

An API endpoint forwards POST data across redirections from external APIs. When an application follows an HTTP redirect and resends the original POST body to the new destination, sensitive data such as credentials, tokens, or personally identifiable information may be unintentionally leaked to an untrusted third party. This behavior may happen when the server returns a 307 or 308 status code.

Rationale

This finding works by identifying an API route that accepts 307 or 308 redirections from a third party API call.

Remediation

  • Configure HTTP clients to not forward POST bodies across redirections
  • Implement explicit redirect handling that validates the target and strips sensitive data before following
  • Ensure that sensitive data is only sent to explicitly trusted endpoints

References

ReferenceDescription
OWASP API10:2023 - Unsafe Consumption of APIsOWASP API Security guidance on safely consuming third-party APIs.