Six Hidden Places Your API Token Leaks When Passed as a URL Query Parameter

·1 views

Embedding API tokens in URL query parameters exposes credentials far beyond the intended server, spreading them across at least six distinct storage locations. These include server access logs, CDN and proxy logs, browser history, Referer headers sent to external servers, third-party analytics platforms, and public web archives. Security researchers found 2.76 million pages with exposed credentials in a single CommonCrawl dataset, illustrating the real-world scale of the risk. The Referer header is considered the most immediate threat, as it silently transmits the token to external servers before any application code runs. Both RFC 6750 (2012) and RFC 9700 (2023) explicitly advise against passing bearer tokens in query strings, with the latest standard upgrading the guidance to a strict prohibition.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Smart RAG Systems Must Learn When to Skip Retrieval Entirely

A growing challenge in production RAG (Retrieval-Augmented Generation) systems is not poor retrieval quality but the failure to decide when retrieval should not happen at all. Engineers at DEV Community highlight that blindly retrieving documents for every query adds latency, cost, and context noise while often producing confidently wrong answers. For example, a query about a live order status should route to an API tool, not a static policy document. Experts recommend building a routing layer that can choose between direct answers, tool calls, RAG retrieval, clarification requests, or refusals based on question type. Teams are also urged to treat retrieval similarity scores as evidence thresholds rather than truth signals, and to evaluate whether retrieval was even necessary — not just whether the final answer appeared correct.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Agent Toolkit Brings Curated Cloud Knowledge and API Access to Coding Agents

AWS has released an Agent Toolkit that equips AI coding agents like Claude Code with curated AWS service knowledge and the ability to call AWS APIs directly. The toolkit consists of two independent components: locally stored Agent Skills, which guide service selection and troubleshooting, and an AWS-managed MCP Server that enables live API calls and documentation searches. Setup requires a single command, but users must have AWS CLI 2.35 or later, the uv package manager, and Node.js v22 or above installed beforehand. A notable configuration requirement is specifying the us-east-1 region, as the toolkit is only served from that region and the setup wizard will fail silently without it. The skills are open source under the Apache-2.0 license and are designed to enforce verification of current data rather than relying on the agent's potentially outdated internal knowledge.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RAG, Memory, or Tools: A Framework for What AI Agents Should Actually Store

A technical guide published on DEV Community breaks down a common architectural challenge in building production AI agents: deciding where different types of information should live. The piece argues that the core mistake is not choosing between RAG, memory, or tools, but blurring their distinct roles together. According to the framework, tools should handle live system state, RAG should serve large read-only knowledge bases, and memory should store durable, scoped user facts across sessions. The context window is recommended only for temporary working state, while raw conversation logs should not be treated as memory without a clear retrieval and privacy plan. The overall guidance stresses that agents should store less than teams typically assume, but whatever is stored must be deliberate, scoped, and set to expire when no longer accurate.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI-Generated n8n Workflows Need Structured Review Pipelines, Not Just Human Eyes

AI tools can now generate n8n automation workflows quickly, but their speed and ease of creation introduce serious operational risks that manual review alone cannot catch. A workflow produced by an AI may run successfully while silently performing unintended actions, such as exposing sensitive data, using over-privileged credentials, or triggering costly API loops. Experts argue that AI-generated workflows should be treated as untrusted executable code rather than harmless suggestions, since they can directly interact with production systems, databases, and third-party services. A reliable review process should combine automated linting, policy checks, execution manifests, and runtime gates alongside human approval, rather than depending on a single reviewer. The core argument is that the reviewer should be a structured pipeline — not an individual — to handle the volume and complexity that AI-assisted workflow generation introduces.

0 comments Read more at DEV Community