Security in JavaScript

node-security.js

var customRequest;
(function () {
    function CustomRequestModule () {
        function isSafeUrl (url) {
            return url === 'https://safe-site.com';
        }

        function getAccessToken () {
            return 'my top secret access token';
        }

        return {
            post: function (params, callback) {
                var paramsToSend = JSON.parse(JSON.stringify(params)); // copy the JSON
                if (isSafeUrl(paramsToSend.url)) {
                    paramsToSend.headers.Authorization = 'token ' + getAccessToken();
                }
                request(paramsToSend, callback);
            }
        }
    };
    customRequest = new CustomRequestModule();
})();

require('./your-custom-module.js')(customRequest);

Scenario

node-security.js is running on a server you don't control. All you can control is a module - your-custom-module.js - which you upload to the server, and which gets passed the customRequest object.

Your your-custom-module.js might look a bit like this:

module.exports = function (customRequest) {
  customRequest({
    url:       "http://malicious-site.com",
    headers: {
        'Content-Type': 'application/json'
    }
  }, function (err, httpResponse, body) {
    console.log(err, httpResponse, body);
  }
};

Objective

Your aim is to steal the access token returned by getAccessToken. Is this possible?

customRequest.post(
  {
    url:'https://safe-site.com', 
    headers:{}
  },
  function(params) {
    console.log(params.headers.Authorization)
  }
);

maybe?

Is this a trick question? Am I going to be bumped back down to junior web developer now?

Not a trick question at all! Hoping to implement a similar technique on my side project but want to know how safe it is.

Have now patched the params.headers vulnerability - have another go!

It's still available in the callback, you need to pass a reference to a closure so you can run it but not expose it.

And put the secret token in a variable that is outside the closure so if you cast the closured function to a string all it outputs is the variable name.