Mapbox-gl-js: ACCESS_TOKEN stored in localStorage

[prachikhadke]

Per mapbox.js#L231 and mapbox.js#L197, the mapBox ACCESS_TOKEN is stored in the browser localStorage. This is a security breach as it becomes available to the end client user even if they have been properly authenticated and authorized.

mapbox-gl-js version: v0.53.0-beta.1 as well as master

[asheemmamoowala]

Thank you for opening this issue @prachikhadke! Can you please report this via https://www.mapbox.com/platform/disclosure/ to get the attention of our security team?

[andrewharvey]

This is a security breach as it becomes available to the end client user even if they have been properly authenticated and authorized.

Is this really an issue? The client always has that access token regardless if it's stored in local storage or not. :confused:

[prachikhadke]

This is a security breach as it becomes available to the end client user even if they have been properly authenticated and authorized.

Is this really an issue? The client always has that access token regardless if it's stored in local storage or not. 😕

The mapbox client (i.e. client code that use mapbox code) do have the access token. but the end user using the client code application shouldn't.

[prachikhadke]

Thank you for opening this issue @prachikhadke! Can you please report this via https://www.mapbox.com/platform/disclosure/ to get the attention of our security team?

Submitted report https://hackerone.com/reports/492285

[mourner]

but the end user using the client code application shouldn't.

Any time you do "View source" on a Mapbox map, or open the Network tab of DevTools, you'll see the access token — it is public (and the Mapbox tokens page even says explicitly that it's a public token). I think this is not an issue.

[prachikhadke]

but the end user using the client code application shouldn't.

Any time you do "View source" on a Mapbox map, or open the Network tab of DevTools, you'll see the access token — it is public (and the Mapbox tokens page even says explicitly that it's a public token). I think this is not an issue.

That's exactly my point. It shouldn't be accessible via DevTools. It shouldn't be public.

[mourner]

@prachikhadke how do you expect it to be hidden? It's a part of the tile requests from the web page. It's impossible to make it private — that's not how the Web works.

[prachikhadke]

@prachikhadke how do you expect it to be hidden? It's a part of the tile requests from the web page. It's impossible to make it private — that's not how the Web works.

True. I can understand that. Ok. I am okay with this then.

[mourner]

@prachikhadke thank you! We should definitely improve docs / communication around this, and still investigating internally on next actions.