Your Password, in the Address Bar — JavaScript Bug Hunt

Briefing

Modelled on Instagram's November 2018 disclosure. Instagram told some users that its "Download Your Data" tool had put their password in the URL of the page in their browser, and that the passwords had been stored on Facebook's servers as a result. A URL ends up in browser history, proxies and server access logs, none of which treat it as a secret.

This reconstruction's client sends the credential as query parameters, and the (locked) server logs every request line.

Fix buildRequest so the password travels in the request body.

Bug report

BUG-IG-1811 · Priority: Critical · Reported by: security

buildRequest(username, password) must return: { method: "POST", url: "/accounts/data_download/request", body: { username: <username>, password: <password> } }

• the URL is exactly the path: no query string, no credential in it
• the server must still accept a correct password (200) and refuse a wrong one (403)

Observed: the access log contains lines like "GET /accounts/data_download/request?username=kai&password=…".

Logs

[edge] GET /accounts/data_download/request?username=kai&password=hunter2 200
[logs] shipped 1 access-log batch to shared storage

The code as shipped

src/privacy/downloadClient.js (editable)

var PATH = "/accounts/data_download/request";
exports.PATH = PATH;

exports.buildRequest = function (username, password) {
  return {
    method: "GET",
    url: PATH + "?username=" + encodeURIComponent(username) + "&password=" + encodeURIComponent(password),
    body: null
  };
};

Read-only context: src/privacy/server.js.