Rules Hub
Code Ruleset
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Never put secrets or tokens in a URL query string
Send auth tokens as headers, never as query-string parameters.
Bad example
| 1 | const url = `${baseUrl}/users.json?auth_token=${encodeURIComponent(token)}&limit=${limit}`; |
| 2 | await fetch(url); |
Explanation (EN)
URL query credentials spread through more logging and sharing surfaces than an explicitly protected auth header.
Objašnjenje (HR)
Vjerodajnice u URL upitu lakše završe u logovima i dijeljenim poveznicama nego u posebno zaštićenom autentifikacijskom headeru.
Good example
| 1 | const url = `${baseUrl}/users.json?limit=${limit}`; |
| 2 | await fetch(url, { headers: { Authorization: `Bearer ${token}` } }); |
Explanation (EN)
Pass the token as an Authorization header so it never appears in the request line that gets logged. If the third-party API genuinely only accepts the token as a query parameter, say so explicitly in a comment so the tradeoff is visible on review rather than looking like an oversight.
Objašnjenje (HR)
Proslijedi token kao Authorization header kako se nikad ne bi pojavio u liniji zahtjeva koja se logira. Ako vanjski API stvarno prihvaća token samo kao query parametar, to izričito navedi u komentaru kako bi kompromis bio vidljiv pri reviewu, a ne izgledao kao previd.
Notes (EN)
Use the protocol's authorization header or secure session mechanism so credentials do not enter URLs, browser history, referrers and common request-line logs.
Exceptions / Tradeoffs (EN)
Some signed-resource or third-party protocols require URL credentials; use scoped short lifetimes, redact logs/referrers and avoid shared caching rather than silently removing required authentication.