Using GitHub's REST API to list public repos from my external site deletes my token

Question

I am trying to list my GitHub public repos on my public website using their REST API. I have been creating personal tokens so far. In localhost it works.

When I do the request from my site it responds a 401 and it deletes my token.

To get the repos I am doing this simple request:

async function loadRepositories() {
  const token = 'my_token';

  const response = await fetch("https://api.github.com/users/tauromachian/repos",
    {
      method: "GET",
      headers: {
        Authorization: `Bearer ${token}`,
      },
    }
  );
  const repositories = await response.json();

  return repositories;
},

How can I get this done?

@DanielA.White I explained the error in the question. Also, what's a PAT? — jogarcia, Feb 05 '23 at 16:37
@DanielA.White In the real code I get the token from the environment. I simplified that for this question. — jogarcia, Feb 05 '23 at 16:40
Are you checking the PAT into the repository? If so, GitHub may very well be automatically expiring it depending on certain policies because that's not secure, so don't do that. — bk2204, Feb 05 '23 at 16:43
Which HTTP status code do you get? 401? You shouldn't make the request on the client side as you will need to provide the personal access token there. Instead make the request on the server side and call your server endpoint from your public client. This way you won't expose the PAT. Probably Github deletes the token as it notices you are publicly exposing the PAT for your own security. — Mushroomator, Feb 05 '23 at 16:43
@DanielA.White Updated my question to include the exact error. I do think it's expiring it in some manner. — jogarcia, Feb 05 '23 at 16:47
@Mushroomator So, I can't get the repos directly from GitHub? — jogarcia, Feb 05 '23 at 16:48
@Mushroomator You may as well make that the answer given that there won't be any other. — jogarcia, Feb 05 '23 at 16:49

score 1 · Accepted Answer · answered Feb 05 '23 at 16:59

Github is trying to protect you from someone stealing your identity here. There are ways to detect if a HTTP request is sent from the browser or a server (it's not 100% reliable though).

As you make the request from the browser which is a public client, meaning everyone can read the code and hence secrets you use within the code you are exposing your Personal Access Token (PAT). This PAT identifies you against Github, therefore if someone else could get hold of it, they can impersonate you and e.g. delete repos, steal code etc. (if the token has the correct scopes). As Github wants to prevent that from happening, they delete tokens which are publicly exposed (they know it's exposed as the the request comes from a browser). Therefore attacks like that are not possible anymore.

To make your website work however you can simply make the request from your server as you can securely store secrets on the server-side and call the endpoint of your server from your website. Once you do that, Github won't delete the token, your token is save and you can display the data on the website.

Using GitHub's REST API to list public repos from my external site deletes my token

1 Answers1