codemod/axios-basic-auth-with-env
Transforms hardcoded Basic Authentication headers in Axios requests to use environment variables instead
# Replace Hardcoded Axios Basic Auth with Environment Variables
A security-focused codemod that automatically transforms hardcoded Basic Authentication credentials in Axios requests to use environment variables instead, eliminating the risk of exposing sensitive credentials in source code.
## Security Issue
**CWE-798: Use of Hard-coded Credentials**
Hardcoded credentials in source code pose significant security risks:
- Credentials are visible to anyone with repository access
- Secrets are stored in version control history
- Production credentials may be accidentally committed
- No easy way to rotate credentials without code changes
This codemod addresses OWASP Top 10 2021 - A07: Identification and Authentication Failures.
## Installation
```bash
# Run directly from the registry
npx codemod@latest run @codemod/replace-hardcoded-axios-basic-auth-with-env-vars
# Or install and run locally
npm install -g @codemodcom/cli
codemod run replace-hardcoded-axios-basic-auth-with-env-vars
```
## What it transforms
### 1. Axios instance creation with auth objects
**Before:**
```javascript
const api = axios.create({
auth: {
username: 'admin',
password: 'secret123'
}
});
```
**After:**
```javascript
const api = axios.create({
auth: {
username: process.env.API_USERNAME,
password: process.env.API_PASSWORD
}
});
```
### 2. Individual axios method calls with auth
**Before:**
```javascript
axios.get('https://api.example.com/data', {
auth: {
username: 'user@example.com',
password: 'mypassword'
}
});
```
**After:**
```javascript
axios.get('https://api.example.com/data', {
auth: {
username: process.env.API_USERNAME,
password: process.env.API_PASSWORD
}
});
```
### 3. Basic Authorization headers
**Before:**
```javascript
const config = {
headers: {
'Authorization': 'Basic YWRtaW46c2VjcmV0MTIz'
}
};
```
**After:**
```javascript
const config = {
headers: {
'Authorization': `Basic ${Buffer.from(`${process.env.API_USERNAME}:${process.env.API_PASSWORD}`).toString('base64')}`
}
};
```
### 4. Axios defaults headers
**Before:**
```javascript
axios.defaults.headers.common['Authorization'] = 'Basic dXNlckBleGFtcGxlLmNvbTpteXBhc3N3b3Jk';
```
**After:**
```javascript
axios.defaults.headers.common['Authorization'] = `Basic ${Buffer.from(`${process.env.API_USERNAME}:${process.env.API_PASSWORD}`).toString('base64')}`;
```
## What it doesn't transform
- Files already using environment variables (`process.env.*`)
- Test files with mock/placeholder credentials
- Template files with variable placeholders (`${VAR}`, `{{VAR}}`)
- Non-basic authentication methods (Bearer tokens, API keys)
- Dynamic credential retrieval from secure stores
- Comments or documentation with example credentials
## Environment Variables
After running this codemod, you'll need to set these environment variables:
```bash
# .env file
API_USERNAME=your_actual_username
API_PASSWORD=your_actual_password
```
Or set them in your deployment environment:
```bash
export API_USERNAME=your_actual_username
export API_PASSWORD=your_actual_password
```
## Supported File Types
- JavaScript (`.js`)
- TypeScript (`.ts`)
- JSX (`.jsx`)
- TSX (`.tsx`)
## Security Benefits
✅ **Eliminates credential exposure** in source code
✅ **Prevents accidental commits** of production secrets
✅ **Enables credential rotation** without code changes
✅ **Supports different credentials** per environment
✅ **Improves security posture** according to security best practices
## Development
```bash
# Install dependencies
pnpm install
# Run tests
pnpm test
# Update test snapshots
pnpm test -u
# Validate the codemod
codemod validate -w workflow.yaml
```
## References
- [CWE-798: Use of Hard-coded Credentials](https://cwe.mitre.org/data/definitions/798.html)
- [OWASP Top 10 2021 - A07: Identification and Authentication Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)
- [Axios Documentation: Request Config](https://axios-http.com/docs/req_config)
- [Node.js process.env Documentation](https://nodejs.org/api/process.html#processenv)
## License
MIT