global axios.interceptors is vulnerable

[Skn0tt]

Hi there! I'm a big fan of what the Digital Service is doing, and was browsing through the code out of interest.

In

useid-eservice-sdk/src/UseIdAPI.ts

Line 11 in 7e8906d

axios.interceptors.request.use(config => {

, and I think in some other places as well, you're using axios.interceptors.request.use from the global axios import. This injects your API Key into the global axios namespace, and it'll also be added onto other axios requests. This includes requests that are made inside other packages that also use axios, and could result in API Keys being sent to endpoints that it shouldn't be sent to. It also breaks if a package consuming the SDK is also using the global interceptors.

To fix it, I'd recommend to use an Axios Instances. It achieves exactly what you're looking for, and doesn't suffer from the same global-namespace problem.

[mpanne]

Hi @Skn0tt, thank you for your interest in the project and for pointing out this issue. We will look into it and take care!
Feel free to create a PR, though, if you feel the urge. 😉

[Skn0tt]

Absolutely! Opened #4 :)