From 34c910e1317d68f9127e3b8c1d143a031ab7d8fb Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 16:18:16 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20security:=20move=20IMAP=20creden?=
 =?UTF-8?q?tials=20to=20request=20body?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Moved IMAP credentials from query parameters to the request body
for the test-connection endpoint to prevent cleartext logging.
Implemented a Pydantic model (IMAPTestRequest) for request body validation.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 backend/app/api/api_v1/endpoints/imap.py | 36 +++++++++++++-----------
 1 file changed, 20 insertions(+), 16 deletions(-)

diff --git a/backend/app/api/api_v1/endpoints/imap.py b/backend/app/api/api_v1/endpoints/imap.py
index 94940d9..1c8bf9e 100644
--- a/backend/app/api/api_v1/endpoints/imap.py
+++ b/backend/app/api/api_v1/endpoints/imap.py
@@ -1,39 +1,43 @@
 import logging
 from datetime import datetime
-from typing import Any, Dict
+from typing import Any, Dict, Optional
 
 from app.core.security import require_admin_auth
 from app.services.imap_client import IMAPClient
 from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
+from pydantic import BaseModel
 
 router = APIRouter()
 logger = logging.getLogger(__name__)
 
 
+class IMAPTestRequest(BaseModel):
+    """IMAP connection test request body"""
+
+    server: Optional[str] = None
+    port: int = 993
+    username: Optional[str] = None
+    password: Optional[str] = None
+    ssl: bool = True
+
+
 @router.post("/test-connection")
 async def test_imap_connection(
+    request: IMAPTestRequest,
     auth: dict = Depends(require_admin_auth),
-    server: str = None,
-    port: int = 993,
-    username: str = None,
-    password: str = None,
-    ssl: bool = True,
 ) -> Dict[str, Any]:
     """
     Test connection to an IMAP server and gather mailbox statistics
 
     Security: Requires authentication (X-API-Key or Bearer token)
-    Note: Credentials should be passed in request body, not query params
+    Credentials should be passed in request body
     """
-    # Security: Don't accept credentials in query parameters (they get logged)
-    if any([server, username, password]):
-        logger.warning("IMAP credentials passed as query parameters - this is insecure")
-        raise HTTPException(
-            status_code=400,
-            detail="Credentials should be passed in request body, not query parameters",
-        )
-
-    imap_client = IMAPClient(server=server, port=port, username=username, password=password)
+    imap_client = IMAPClient(
+        server=request.server,
+        port=request.port,
+        username=request.username,
+        password=request.password,
+    )
 
     success, message, stats = imap_client.test_connection()