Api Key Exposure in Chi with Saml

Chi is a lightweight, typed language that compiles to JavaScript and is commonly used for backend services. When Chi services rely on SAML for identity federation, developers often pass bearer tokens or API keys as request headers during service-to-service calls. If those keys are embedded in the Chi source or leaked through logs, an attacker who obtains a SAML assertion or session cookie can leverage it to call downstream APIs that trust the exposed key.

In a SAML flow, the identity provider issues a signed assertion consumed by the service provider. Chi applications may use the attributes or name ID in the assertion to derive authorization decisions, but they may also attach an API key to outbound HTTP requests for calling proprietary or legacy APIs. Because SAML itself does not encrypt the contents of assertions, keys can be exposed if developers inadvertently serialize sensitive configuration into logs or include keys in URLs that appear in browser history or referrer headers.

Another vector involves metadata exposure: Chi services sometimes expose endpoint URLs in client-side bundles or error messages, and if those endpoints require API keys, the keys can be inferred or extracted. When SAML integration is combined with weak secret management, a compromised assertion or session can lead to lateral movement across services that rely on static API keys for access control.

Additionally, improperly scoped SAML attributes may grant elevated roles that allow a Chi service to read configuration containing API keys. If the service does not validate incoming SAML assertions strictly, an attacker could inject crafted assertions that cause the service to disclose keys via debug endpoints or health checks. The combination of SAML-based identity and static API keys in Chi increases the attack surface because either component can expose the other if one layer is misconfigured.

middleBrick detects this risk class during unauthenticated scans by analyzing OpenAPI specs for security schemes and simulating requests that include leaked keys or malformed SAML contexts. If the scan finds endpoints that accept keys in headers or query parameters and also support SAML-based identity flows, it highlights the exposure with severity and remediation guidance. Findings align with OWASP API Top 10 categories such as Broken Object Level Authorization and Security Misconfiguration, and map to compliance frameworks including SOC2 and GDPR.

Remediation focuses on removing static API keys from Chi code and runtime, tightening SAML assertion validation, and ensuring outbound calls use short-lived credentials. Use environment variables or a secrets manager for keys, and avoid logging assertion attributes that may contain sensitive data.

Chi code example: unsafe embedding of API key

import HttpKit/Request
import Chi

let apiKey = "sk_live_abc123"

func handler(req: Request) -> Response {
  let client = HttpClient()
  let downstream = client.get("https://api.vendor.com/data", headers: ["Authorization": "Bearer \(apiKey)"])
  return downstream
}

Chi code example: safe approach using environment variables and assertion validation

import HttpKit/Request
import Chi
import DotEnv

let apiKey = try DotEnv.load().get("API_KEY")

func validateSamlAssertion(assertion: String) -> Bool {
  // Verify signature, audience, issuer, and expiry using your IdP public keys
  // Return true only if validation passes
  return true
}

func handler(req: Request) -> Response {
  guard let saml = req.headers["SAMLAssertion"], validateSamlAssertion(assertion: saml) else {
    return Response(status: .unauthorized)
  }
  let client = HttpClient()
  let downstream = client.get("https://api.vendor.com/data", headers: ["Authorization": "Bearer \(apiKey)"])
  return downstream
}

SAML metadata and assertion validation guidance

• Ensure your Service Provider validates the Signature using the IdP’s public certificate.
• Set appropriate AudienceRestriction to match your SP entity ID.
• Do not rely on NameID or attributes for conveying secrets; treat them as identity claims only.

middleBrick’s CLI can be used to scan Chi services and surface insecure key handling or weak SAML configurations. With the Pro plan, you can enable continuous monitoring so that any new endpoint or configuration change triggers a re-scan. The GitHub Action can fail builds if the risk score drops below your defined threshold, preventing deployments that reintroduce key exposure. For teams using AI-assisted coding, the MCP Server allows you to scan APIs directly from your editor while authoring Chi code.