Summary
Before 0.15.0, @workos-inc/authkit-remix returned sensitive authentication artifacts from the authkitLoader, specifically sealedSession and accessToken. Because these values were returned from the loader, they were embedded into the server-rendered HTML and became readable by any script with access to the page’s DOM (e.g., in the presence of XSS or a malicious browser extension).
- Impact: Exposure of these secrets can lead to session hijacking and unauthorized API access.
- Fix: Version
0.15.0 changes the default behavior so the loader no longer returns sealedSession/accessToken. A secure server-side mechanism is provided to fetch an access token when needed.
Patches
Patched in v0.15.0.
References
cai0duque Analyst
Summary
Before
0.15.0,@workos-inc/authkit-remixreturned sensitive authentication artifacts from theauthkitLoader, specificallysealedSessionandaccessToken. Because these values were returned from the loader, they were embedded into the server-rendered HTML and became readable by any script with access to the page’s DOM (e.g., in the presence of XSS or a malicious browser extension).0.15.0changes the default behavior so the loader no longer returnssealedSession/accessToken. A secure server-side mechanism is provided to fetch an access token when needed.Patches
Patched in v0.15.0.
References