Api Key Exposure in Chi with Basic Auth

Chi is a lightweight HTTP client for Elixir that allows developers to make requests with custom headers, including authorization headers. When an API key is passed using Basic Authentication, it is typically base64-encoded as part of the Authorization header value (e.g., Authorization: Basic base64(credentials)). While base64 is not encryption, sending API keys in this format over unencrypted HTTP exposes the credentials to anyone who can intercept or inspect the traffic. middleBrick flags this as Data Exposure because the API key is not inherently hidden; the security of Basic Auth depends entirely on transport-layer protection.

In Chi, developers might set headers like this:

headers = [
  {"Authorization", "Basic " <> Base.encode64("api_key:secret")}
]

If the request is sent over HTTP instead of HTTPS, an on-path attacker can capture the header using a network sniffer. Even over HTTPS, logging middleware or improperly configured proxies might record the Authorization header, leading to unintended exposure of the API key. middleBrick’s Data Exposure check identifies whether requests include sensitive credentials without encryption and whether logs or error messages might leak the header.

Another vector involves error handling. If Chi requests fail and developers inadvertently include the Authorization header in logs or error reports, the API key becomes accessible to anyone with access to those logs. The scanner tests whether responses contain patterns resembling exposed credentials and checks whether the API key is present in plaintext in application outputs, which could violate compliance requirements such as PCI-DSS and GDPR.

Additionally, Basic Auth does not provide mechanisms for key rotation or scope limitation within the request itself. Once an API key is exposed, it can be reused until manually revoked. middleBrick’s Inventory Management and Data Exposure checks look for missing short-lived tokens or lack of key rotation strategies, which are common when relying solely on static API keys in headers.

The combination of Chi’s straightforward header configuration and the use of Basic Auth can create a false sense of security. Developers might assume that encoding the key is sufficient protection, not realizing that the key is still recoverable and reusable. This pattern is frequently flagged in scans because it mirrors real-world incidents where hardcoded credentials in headers led to breaches.

To reduce exposure when using API keys in Chi, avoid placing sensitive values directly in headers for unencrypted requests. Always enforce HTTPS by using the https: scheme and ensure that all endpoints are served over TLS. Configure Chi to reject insecure connections and redirect HTTP to HTTPS when behind a reverse proxy.

Instead of embedding the API key in the Authorization header for every request, use environment variables and build the header at runtime. This prevents accidental commits of credentials to version control:

import System.get_env

api_key = System.get_env("API_KEY")
headers = [
  {"Authorization", "Basic " <> Base.encode64("#{api_key}:secret")}
]

For higher security, avoid Basic Auth for API keys altogether. Use Bearer tokens or custom authentication schemes that support short lifetimes and scope restrictions. If you must use Basic Auth, rotate credentials frequently and monitor logs for repeated Authorization headers that could indicate exposure attempts.

You can also integrate middleBrick’s CLI to validate your configuration:

$ middlebrick scan https://api.example.com

The scanner will report whether the endpoint transmits credentials over unencrypted channels and whether sensitive patterns appear in responses. For automated protection in development pipelines, the GitHub Action can enforce a minimum security score before allowing merges:

- uses: middlebrick/github-action@v1
  with:
    url: https://api.example.com
    threshold: B

When using Chi in production, ensure that telemetry and logging systems redact Authorization headers. Custom telemetry code should explicitly exclude the header from logs to prevent accidental storage of credentials. These practices align with the remediation guidance provided in middleBrick’s Pro plan, which includes continuous monitoring and configurable alerts for score degradation.