🛡️ Sentinel: [HIGH] Fix Insecure API Endpoint Exposing Integration Credentials

Removed the `/api/integrations/{integration_id}/credentials` endpoint which exposed plaintext credentials.
Created a new `/api/integrations/{integration_id}/test` endpoint to securely perform connection tests server-side.
Updated frontend to use the new secure test endpoint.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
google-labs-jules[bot]
2026-03-23 15:13:35 +00:00
parent 2732dafba9
commit 53961eb2c6
5 changed files with 63 additions and 58 deletions
+3 -15
View File
@@ -1379,27 +1379,15 @@ function integrationsDashboard() {
async testSavedIntegration(intg) {
this.testingId = intg.id;
try {
// Retrieve saved credentials to test
const credsResp = await fetch(`/api/integrations/${intg.id}/credentials`);
if (!credsResp.ok) {
this.showAlert('error', 'Test Failed', 'Could not retrieve saved credentials for testing.');
return;
}
const creds = await credsResp.json();
const resp = await fetch('/api/integrations/test', {
const resp = await fetch(`/api/integrations/${intg.id}/test`, {
method: 'POST',
headers: authHeaders(true),
body: JSON.stringify({
integration_type: intg.integration_type,
config: intg.config,
credentials: creds,
}),
});
const data = await resp.json();
if (data.success) {
if (resp.ok && data.success) {
this.showAlert('success', `${intg.name}: Connection OK`, data.message);
} else {
this.showAlert('error', `${intg.name}: Connection Failed`, data.message);
this.showAlert('error', `${intg.name}: Connection Failed`, data.message || 'Connection test failed.');
}
} catch (err) {
this.showAlert('error', 'Test Failed', `Network error: ${err.message || 'Unknown error'}`);