Summary
quota_http_json() in token_meter/quotas/common.py uses stdlib urlopen, which follows redirects.
Claude sends Authorization: Bearer <oauth access token>. Cursor sends Cookie: WorkosCursorSessionToken=…. Codex OAuth sends a bearer token to chatgpt.com.
Python 3.11+ strips Authorization on cross-host redirects. It does not strip Cookie. Older Python may forward Authorization as well.
Endpoints are fixed today (api.anthropic.com, chatgpt.com, cursor.com), so this is not open SSRF. It is still “if the provider (or a future URL change) 302s, credentials leave the intended host.”
Error handling here is otherwise careful (size cap, sanitized QuotaUnavailable messages, tests in tests/contracts/test_quota_privacy.py).
Suggested fix
Use an opener whose redirect handler refuses to follow, and fail closed. Optionally pin the final URL.
Summary
quota_http_json()intoken_meter/quotas/common.pyuses stdliburlopen, which follows redirects.Claude sends
Authorization: Bearer <oauth access token>. Cursor sendsCookie: WorkosCursorSessionToken=…. Codex OAuth sends a bearer token tochatgpt.com.Python 3.11+ strips
Authorizationon cross-host redirects. It does not stripCookie. Older Python may forwardAuthorizationas well.Endpoints are fixed today (
api.anthropic.com,chatgpt.com,cursor.com), so this is not open SSRF. It is still “if the provider (or a future URL change) 302s, credentials leave the intended host.”Error handling here is otherwise careful (size cap, sanitized
QuotaUnavailablemessages, tests intests/contracts/test_quota_privacy.py).Suggested fix
Use an opener whose redirect handler refuses to follow, and fail closed. Optionally pin the final URL.