Security: enforce HTTPS for baseUrl and stop forwarding auth token to third-party endpoints

python/numbersprotocol_capture/client.py

@@ -153,6 +153,9 @@ def __init__(
         if not token:
             raise ValidationError("token is required")
 
+        if base_url is not None and not base_url.startswith("https://"):
+            raise ValidationError("base_url must use HTTPS")
+
         self._token = token
         self._testnet = testnet
         self._base_url = base_url or DEFAULT_BASE_URL
@@ -448,7 +451,6 @@ def get_history(self, nid: str) -> list[Commit]:
 
         headers = {
             "Content-Type": "application/json",
-            "Authorization": f"token {self._token}",
         }
 
         try:
@@ -513,7 +515,6 @@ def get_asset_tree(self, nid: str) -> AssetTree:
 
         headers = {
             "Content-Type": "application/json",
-            "Authorization": f"token {self._token}",
         }
 
         try:

python/tests/test_client.py

@@ -32,6 +32,16 @@ def test_init_with_custom_base_url(self) -> None:
         assert capture._base_url == "https://custom.api.com"
         capture.close()
 
+    def test_init_with_http_base_url_raises_error(self) -> None:
+        """Test that http base_url raises ValidationError."""
+        with pytest.raises(ValidationError, match="base_url must use HTTPS"):
+            Capture(token="test-token", base_url="http://custom.api.com")
+
+    def test_init_with_non_https_base_url_raises_error(self) -> None:
+        """Test that non-https base_url raises ValidationError."""
+        with pytest.raises(ValidationError, match="base_url must use HTTPS"):
+            Capture(token="test-token", base_url="ftp://custom.api.com")
+
     def test_context_manager(self) -> None:
         """Test client as context manager."""
         with Capture(token="test-token") as capture:

ts/src/client.test.ts

@@ -25,6 +25,23 @@ describe('Capture Client', () => {
     it('should throw error without token', () => {
       expect(() => new Capture({ token: '' })).toThrow('token is required')
     })
+
+    it('should accept https baseUrl', () => {
+      const capture = new Capture({ token: 'test-token', baseUrl: 'https://custom.api.com/v3' })
+      expect(capture).toBeInstanceOf(Capture)
+    })
+
+    it('should reject http baseUrl', () => {
+      expect(() => new Capture({ token: 'test-token', baseUrl: 'http://custom.api.com/v3' })).toThrow(
+        'baseUrl must use HTTPS'
+      )
+    })
+
+    it('should reject non-https baseUrl', () => {
+      expect(() => new Capture({ token: 'test-token', baseUrl: 'ftp://custom.api.com/v3' })).toThrow(
+        'baseUrl must use HTTPS'
+      )
+    })
   })
 })
 

ts/src/client.ts

@@ -147,6 +147,9 @@ export class Capture {
     if (!options.token) {
       throw new ValidationError('token is required')
     }
+    if (options.baseUrl !== undefined && !options.baseUrl.startsWith('https://')) {
+      throw new ValidationError('baseUrl must use HTTPS')
+    }
     this.token = options.token
     this.testnet = options.testnet ?? false
     this.baseUrl = options.baseUrl ?? DEFAULT_BASE_URL
@@ -375,7 +378,6 @@ export class Capture {
       method: 'GET',
       headers: {
         'Content-Type': 'application/json',
-        Authorization: `token ${this.token}`,
       },
     })
 
@@ -431,7 +433,6 @@ export class Capture {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        Authorization: `token ${this.token}`,
       },
       body: JSON.stringify(commitData),
     })