Description: Basic Auth credentials from SE_ROUTER_USERNAME/SE_ROUTER_PASSWORD may be sent to the Node
/status endpoint even when SE_SERVER_PROTOCOL is http, which would expose credentials to
interception on the network (Basic Auth is only safe when enforced over HTTPS/TLS).
video_service.py [332-344]

node_status_url = f"{self.se_server_protocol}://{self.display_container}:{self.se_node_port}/status"
headers = {}
if self.registration_secret:
    headers["X-REGISTRATION-SECRET"] = self.registration_secret
if self.router_username and self.router_password:
    auth_token = base64.b64encode(f"{self.router_username}:{self.router_password}".encode("utf-8")).decode(
        "utf-8"
    )
    headers["Authorization"] = f"Basic {auth_token}"
    logger.info("Using Basic Auth for Node /status endpoint")
elif self.router_username or self.router_password:
    logger.warning("Partial SE_ROUTER credentials provided; skipping Basic Auth for Node /status endpoint")

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Audit context missing: The new Basic Auth usage logging does not include sufficient audit context (e.g.,
actor/user identity, target, and outcome) to support reconstruction of
authentication-related access to the /status endpoint if that action is considered
critical in your audit policy.

if self.router_username and self.router_password:
    auth_token = base64.b64encode(f"{self.router_username}:{self.router_password}".encode("utf-8")).decode(
        "utf-8"
    )
    headers["Authorization"] = f"Basic {auth_token}"
    logger.info("Using Basic Auth for Node /status endpoint")
elif self.router_username or self.router_password:
    logger.warning("Partial SE_ROUTER credentials provided; skipping Basic Auth for Node /status endpoint")

Learn more about managing compliance generic rules or creating your own custom rules

Add a security warning if Basic Auth is used over a non-HTTPS connection to
alert the user about potential credential exposure.

Video/video_service.py [336-341]

 if self.router_username and self.router_password:
-    auth_token = base64.b64encode(f"{self.router_username}:{self.router_password}".encode("utf-8")).decode(
-        "utf-8"
-    )
+    if self.se_server_protocol.lower() != "https":
+        logger.warning("Basic Auth over non-HTTPS may expose credentials")
+    auth_token = base64.b64encode(f"{self.router_username}:{self.router_password}".encode()).decode()
     headers["Authorization"] = f"Basic {auth_token}"
     logger.info("Using Basic Auth for Node /status endpoint")

• Apply / Chat

Add .strip() when reading the SE_ROUTER_USERNAME and SE_ROUTER_PASSWORD
environment variables to remove any leading or trailing whitespace.

Video/video_service.py [137-138]

-self.router_username = os.environ.get("SE_ROUTER_USERNAME", "")
-self.router_password = os.environ.get("SE_ROUTER_PASSWORD", "")
+self.router_username = os.environ.get("SE_ROUTER_USERNAME", "").strip()
+self.router_password = os.environ.get("SE_ROUTER_PASSWORD", "").strip()

• Apply / Chat