UMalik214428 (Community Member) asked a question.
"CWE-259: Use of Hard-coded Password" flaw in my React app's fetch calls to my API
I use a 3rd party auth service to obtain an access token when the user logs into my website. The token is kept in memory and then included in all calls to my API as follows:
fetch(url, {
method: "get",
mode: "cors",
credentials: "include", // <<<--- the flaw complains about this line
headers: {
authorization: "Bearer " + accessToken
}
})
How do I convince the static scan that I am NOT hard-coding any password? Any help would be appreciated.
.png){kind=logo}
Hi @UMalik214428 (Community Member),
I would recommend marking this as a false positive through a mitigation proposal and discussing it with your organization's Security Team for approval. For more information on how to propose a mitigation, please refer to https://docs.veracode.com/r/improve_mitigation.
Thank you,
Florian Walter