Gemini CLI patch blocks credential leakage by forcing HTTPS for auth provider
amelidev · ghdev · 2026-07-24
A GitHub pull request for google-gemini/gemini-cli adds an HTTPS enforcement check to GoogleCredentialsAuthProvider.
The change is meant to stop Application Default Credentials access and identity tokens from being sent over plain HTTP, reducing the risk of cleartext leakage and MITM interception.
Key points:
- Verifies that targetUrl uses https: during provider initialization
- Blocks high-privilege tokens, including broad-scope cloud-platform credentials, from going over HTTP
- Adds unit tests for both the auth provider and the leak-prevention path
The PR also documents how to run the targeted test files.
More from coding & agent
- Routing beat three other agent orchestration patterns in a demo benchmark — mastra_ai · 2026-07-24
- Model Routers Can Break Context Cache in Multi-Turn Chats, Incurring Penalties — pvncher · 2026-07-24
- AI Agent Demonstrates Autonomy by Generating Long-Term Goals Unprompted — QuixiAI · 2026-07-24
- Claude researched haiku scholarship before writing a reusable skill, then a caveman mode made it funny — Fade78 · 2026-07-24
- Developer intelligence dashboard spots one engineer spending $20,145 on AI in 30 days — alex_verem · 2026-07-24
- Codex on a Cloud VM: Unleash the AI Coding Agent — paw_lean · 2026-07-24