Gemini CLI patch blocks credential leakage by forcing HTTPS for auth provider
amelidev · ghdev · 2026-07-24
A GitHub pull request for google-gemini/gemini-cli adds an HTTPS enforcement check to GoogleCredentialsAuthProvider.
The change is meant to stop Application Default Credentials access and identity tokens from being sent over plain HTTP, reducing the risk of cleartext leakage and MITM interception.
Key points:
- Verifies that targetUrl uses https: during provider initialization
- Blocks high-privilege tokens, including broad-scope cloud-platform credentials, from going over HTTP
- Adds unit tests for both the auth provider and the leak-prevention path
The PR also documents how to run the targeted test files.
More from coding & agent
- Sol61 flunks instruction-following: skips mandated research even when explicitly told — lucasmeijer · 2026-10-26
- Ben Bajarin: Frontier AI is becoming the enterprise cyber-defense stack — BenBajarin · 2026-10-26
- Building AI bots on raw APIs? Devs say models are 'dumb without the harness' — madeofAjala · 2026-10-26
- HarnessMM cuts agent tokens per task by up to 88% while raising success rates — omarsar0 · 2026-10-26
- Microsoft demos intent-classifying agents built with Copilot App and Foundry, deployable across Teams and Outlook — marlene_zw · 2026-10-26
- Looking for a wearable mic with best battery life that feeds recordings to personal agents via MCP — altryne · 2026-10-26