Api Key Exposure in Fiber with Api Keys

In Go Fiber applications, storing and transmitting API keys insecurely can lead to credential leakage and unauthorized access to backend services. The risk typically arises when API keys are embedded directly in source code, configuration files, or environment variables that are inadvertently exposed through logs, error messages, or version control. In a black-box scan, middleBrick checks for indicators such as keys appearing in HTTP response bodies or headers, references in client-side JavaScript, or debug endpoints that echo configuration. Because API keys often authorize access to payment processors, cloud services, or third-party APIs, exposure can enable lateral movement and data exfiltration.

When API keys are passed in request headers, query parameters, or cookies without adequate protection, they may be intercepted or logged. For example, a route that forwards requests with an API key in a query string can leak the key in server access logs or browser history. middleBrick’s Data Exposure and Property Authorization checks look for missing redaction, overly permissive CORS, and endpoints that return sensitive configuration. The scanner also tests for Reflected XSS that could steal keys stored in JavaScript variables, and checks whether keys are transmitted over non-encrypted channels, which would trigger the Encryption check.

Another vector specific to Fiber is the use of middleware that conditionally injects API keys based on environment or route patterns. If the logic that determines when to add a key is flawed, the key might be attached to responses that should remain internal, such as health checks or error pages. During an active scan, middleBrick follows request flows to see whether API keys appear where they should not, including in error responses or cross-origin requests. Because keys may be reused across services, a single exposure can affect multiple integrations, which is why inventory management and data exposure checks are run in parallel with authentication and authorization tests.

Secure handling of API keys in Fiber focuses on minimizing exposure, enforcing transport security, and avoiding accidental leakage in logs or responses. The following examples assume you are using environment variables and structured configuration rather than hardcoded values.

Example 1: Injecting API keys only to authorized outbound requests

Instead of attaching API keys to every response or logging them, inject them only where needed using a controlled client. This reduces the surface area for accidental disclosure.

import { Router } from 'express';
import axios from 'axios';
import dotenv from 'dotenv';

dotenv.config();

const app = require('fastify')();
const externalRouter = Router();

const apiKey = process.env.EXTERNAL_API_KEY;
if (!apiKey) {
  throw new Error('Missing required environment variable EXTERNAL_API_KEY');
}

externalRouter.get('/resource', async (req, res) => {
  try {
    const response = await axios.get('https://api.example.com/data', {
      headers: { Authorization: `Bearer ${apiKey}` },
      timeout: 5000,
    });
    res.json(response.data);
  } catch (error) {
    // Avoid leaking key or stack traces in error responses
    res.status(502).json({ error: 'upstream service error' });
  }
});

app.use('/external', externalRouter);
app.listen(3000);

Example 2: Preventing keys in logs and error messages

Ensure that logging and error handling do not include sensitive values. Sanitize any output that could be returned to the client or written to log streams.

import { logger } from './logger';

app.use(async (req, res, next) => {
  const originalSend = res.send;
  res.send = function (body) {
    if (typeof body === 'string' && body.includes(process.env.API_KEY)) {
      logger.warn('Potential key exposure in response body');
      body = body.replace(new RegExp(process.env.API_KEY, 'g'), '[REDACTED]');
    }
    return originalSend.call(this, body);
  };
  next();
});

Example 3: Securing environment and build-time exposure

Use .env.example without real values and enforce secret scanning in CI. This prevents keys from appearing in repositories or build artifacts.

# .env.example
EXTERNAL_API_KEY=your_api_key_here
# Do not commit actual keys to version control

In production, inject secrets via your hosting platform’s secure parameter store so that keys are never present in the source tree. Combine this with runtime checks that reject startup if required variables are missing, as shown in Example 1.