This is an egregious and easily avoidable security vulnerability. JWTs should not be set client-side in a browser or they can be scraped by 3rd parties.
The actual solution was to simply add ‘withCredentials: true’ in the request helper’s options. If we were flying in blind without knowing that, it would have appeared like the LLM gave us a valid solution that worked, but in reality it was a critical mistake.
I think the models will probably get smart enough to avoid this particular error tho
Mitch Downey :pci:
npub1yf…w6g6v
2026-01-17 13:32:11 UTC
in reply to nevent1q…9ayn
Author Public Key
npub1yfr5d05qj3qzz84kntze3c8accyz0unwczgm0fxuypuqdnenkwuqew6g6vSeen on
wss://relay.ditto.pubPublished at
2026-01-17 13:32:11 UTCEvent JSON
{
"id": "5ac0d3193a1ba825f84648e84353460f309d098b8b70d3382abf03398dfca987",
"pubkey": "224746be809440211eb69ac598e0fdc60827f26ec091b7a4dc207806cf33b3b8",
"created_at": 1768656731,
"kind": 1,
"tags": [
[
"e",
"1d00c6963953ff6660ad5ecb3fa190cab617adbe2791d0e09634f98d9060b6a0",
"wss://relay.ditto.pub",
"reply"
],
[
"proxy",
"https://podcastindex.social/users/mitch/statuses/115910687526583403",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "This is an egregious and easily avoidable security vulnerability. JWTs should not be set client-side in a browser or they can be scraped by 3rd parties.\n\nThe actual solution was to simply add ‘withCredentials: true’ in the request helper’s options. If we were flying in blind without knowing that, it would have appeared like the LLM gave us a valid solution that worked, but in reality it was a critical mistake.\n\nI think the models will probably get smart enough to avoid this particular error tho",
"sig": "3683ff699c66ba78b5584e4d92601d04ae66f75a8d330a86d206c388a25eb898f26eed9eb648f48fe3d82c56aa3d5b1dcf3b2c6af3eb5fc516fa6d6a2063534b"
}