Reporter token leaked via URL

[simonforsberg]

⚠️ Potential issue | 🟠 Major

Reporter token leaked via URL; also not URL-encoded on redirect.

Two concerns with propagating the token through query strings:

1. Leakage. Placing the reporter token in the URL query string exposes it in browser history, server access logs, proxy logs, and Referer headers sent to any third-party resources embedded on the downstream page. Since this token is a bearer credential granting access to the ticket and its comments, this materially weakens its security. Consider using a short-lived signed cookie scoped to the ticket path instead, or rotating the token after use.
2. Encoding. "?token=" + token concatenates user-supplied input into a redirect Location header without URL-encoding. In practice UUIDs are safe, but if the token format ever changes (or a malformed value is submitted), this could cause header/URL parsing issues. Use UriComponentsBuilder or URLEncoder.encode(token, StandardCharsets.UTF_8).

🔒 Minimal encoding fix (if the redirect target remains URL-based)

-        return "redirect:/view/id/" + ticketId + (token != null ? "?token=" + token : "");
+        String base = "redirect:/view/id/" + ticketId;
+        return token != null
+                ? base + "?token=" + URLEncoder.encode(token, StandardCharsets.UTF_8)
+                : base;

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/main/java/org/example/alfs/controllers/TicketCommentController.java`
around lines 31 - 37, The redirect currently appends the reporter token into the
URL ("redirect:/view/id/" + ticketId + (token != null ? "?token=" + token : ""))
which leaks the bearer token and is not URL-encoded; instead, after calling
commentService.addComment(ticketId, dto, user, token) in TicketCommentController
(the method that calls getCurrentUserOrNull and commentService.addComment),
remove the token from the query string and set it as a short-lived, HttpOnly,
secure cookie scoped to the ticket path (e.g. /view/id/{ticketId}) or rotate the
token server-side and store the rotated value in a cookie; if you must keep a
URL redirect, URL-encode the token using UriComponentsBuilder or
URLEncoder.encode(token, StandardCharsets.UTF_8) before concatenation and prefer
rotating/invalidating the token immediately after use.

Originally posted by @coderabbitai[bot] in #26 (comment)

[coderabbitai]

🔗 Related PRs

#3 - Feature/dto [merged]
#6 - Feature/non editable ticket [merged]
#14 - Implement ticket access control and status workflow [merged]
#19 - Add ticket comment functionality with access control [merged]
#23 - Feature/preview flow [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!