security

Security Fix

Find and fix security issues in $ARGUMENTS (or the whole app if no argument is given). Work through every step below in order. Every step that finds an issue must also fix it.

---

Step 1 — Map the attack surface

Read these files before checking anything:

• src/main.tsx / src/App.tsx — entry point, routing, auth gating
• vite.config.ts — dev server proxy, CORS, headers
• package.json — list of third-party dependencies
• Any file matching **/auth*, **/login*, **/token*, **/credential*

Identify:

• All pages/routes and whether each is behind an auth guard
• All places where external data enters the app (CDF SDK calls, fetch, user form input)
• All places where data is written back (CDF upsert, fetch POST/PUT/DELETE)

---

Step 2 — Migrate all CDF access to the Cognite SDK

All traffic to Cognite Data Fusion (CDF) must go through the official Cognite SDK. Find any HTTP, WebSocket, or other network call to CDF-like hosts or APIs that bypasses the SDK and rewrite it to use the SDK.

Search for raw HTTP calls

# Find fetch, axios, XMLHttpRequest, and other HTTP client usage
grep -rn --include="*.ts" --include="*.tsx" --include="*.js" \
  -E "(fetch\(|axios\.|axios\(|XMLHttpRequest|\.ajax\(|http\.get\(|http\.post\(|request\()" src/

# Find raw URL construction that looks like CDF endpoints
grep -rn --include="*.ts" --include="*.tsx" \
  -E "(cognitedata\.com|cognite\.ai|/api/v1/projects|cdf\.|\.cognite\.)" src/

# Find custom Authorization or api-key headers
grep -rn --include="*.ts" --include="*.tsx" \
  -E "(Authorization|api-key|apikey|x-api-key)" src/ | grep -v "node_modules"

How to fix

For each raw CDF call found, read the surrounding code to understand what CDF resource and operation it targets, then rewrite it using the appropriate SDK method. Remove the raw HTTP client import if it's no longer used.

Pattern	Action
fetch() or axios call to a CDF URL (*.cognitedata.com, /api/v1/projects/*)	Rewrite to use the Cognite SDK (cognite.files.getDownloadUrls(...), cognite.timeseries.retrieve(...), client.instances.search(...), etc.)
Custom Authorization header with a CDF token	Remove — the SDK handles auth automatically
WebSocket connection to CDF endpoints	Rewrite to use SDK streaming methods
Proxy endpoint that forwards to CDF internally	Rewrite the proxy to use the SDK internally
fetch() to a non-CDF URL (static assets, documented third-party API)	Leave — but add a comment documenting why it's needed