Api Key Exposure in Fiber with Dynamodb

When an API built with Fiber uses Amazon DynamoDB as its persistence layer, mishandling of API keys can expose both service credentials and user data. In this combination, keys are often embedded in environment configuration read by the Fiber app or passed via HTTP headers and query parameters. If the Fiber route does not validate or sanitize incoming requests, an attacker can manipulate paths or parameters to cause the application to retrieve and reflect the wrong item attributes, including fields that contain stored API keys or secrets.

DynamoDB itself does not leak keys, but the way data is modeled and accessed in the Fiber application can inadvertently surface them. For example, using a user identifier directly as a DynamoDB partition key without additional authorization checks can enable a BOLA/IDOR scenario: an authenticated user can iterate over numeric IDs and read items that belong to other users. If those items contain attributes such as apiKey or secret, the keys are exposed in HTTP responses, logs, or error messages. A common root cause is trusting client-supplied input for key names or conditional expressions used in the DynamoDB query, which can lead to over-fetching or returning sensitive attributes.

Middleware and instrumentation in Fiber can also contribute to exposure. If route handlers log request parameters or DynamoDB responses verbosely, API keys stored in item attributes may appear in structured or unstructured logs accessible to broader audiences. In addition, misconfigured CORS or missing input validation allows injection of unexpected query parameters that change the shape of the DynamoDB scan or query, increasing the likelihood of returning key material. Because DynamoDB stores data schemaless, an application can inadvertently return nested attributes containing keys if the projection expression is too permissive or omitted entirely.

Real attack patterns mirror findings from the LLM/AI Security and BOLA checks in middleBrick: an unauthenticated or low-privilege endpoint can be probed to discover whether API key attributes are returned. For instance, a crafted request with an unexpected filterExpression or an altered partition key can reveal whether the response includes sensitive metadata. This aligns with the OWASP API Top 10 A01:2023 broken object level authorization and A05:2023 injection risks, where improper access control around data storage surfaces sensitive information.

Using middleBrick’s free tier, developers can quickly scan their Fiber endpoints that rely on DynamoDB to detect whether API key attributes appear in output fields. The scanner performs unauthenticated checks across multiple security categories and returns a risk score with prioritized findings and remediation guidance, helping teams identify unsafe exposure before an attacker does. For teams needing continuous coverage, the Pro plan provides scheduled scans and alerts when new findings appear, while the CLI allows integration into local development workflows.

Secure integration between Fiber and DynamoDB starts with strict access patterns, explicit projections, and defensive coding. The following examples demonstrate concrete fixes that reduce the risk of API key exposure.

1. Use server-side environment variables for keys

Never embed API keys in client requests or logs. Store sensitive values in environment variables on the server and reference them securely within your Fiber handlers.

// server.js
require('dotenv').config();
const { DynamoDBClient, GetItemCommand } = require('@aws-sdk/client-dynamodb');
const app = require('fastify')();

const client = new DynamoDBClient({ region: 'us-east-1' });

app.get('/profile/:userId', async (req, reply) => {
  const { userId } = req.params;
  const params = {
    TableName: process.env.DYNAMODB_TABLE,
    Key: {
      userId: { S: userId }
    },
    ProjectionExpression: 'userId,email,createdAt'
  };
  const command = new GetItemCommand(params);
  const data = await client.send(command);
  if (!data.Item) {
    return reply.code(404).send({ error: 'Not found' });
  }
  reply.send(data.Item);
});

module.exports = app;

2. Enforce server-side authorization and strict key modeling

Model DynamoDB items so that API keys are stored under a separate, restricted attribute and are never returned to clients. Use a server-side lookup with a Cognito identity or session-derived principal instead of trusting path parameters.

// handlers.js
const { DynamoDBClient, QueryCommand } = require('@aws-sdk/client-dynamodb');
const { unmarshall } = require('@aws-sdk/util-dynamodb');

const client = new DynamoDBClient({ region: 'us-east-1' });

async function getUserDataForClient(userId, callerId) {
  const params = {
    TableName: process.env.DYNAMODB_TABLE,
    IndexName: 'UserIdIndex',
    KeyConditionExpression: 'userId = :uid',
    FilterExpression: 'userId = :callerId',
    ExpressionAttributeValues: {
      ':uid': { S: userId },
      ':callerId': { S: callerId }
    },
    ProjectionExpression: 'userId,email,profileData'
  };
  const { Items } = await client.send(new QueryCommand(params));
  return Items ? Items.map(unmarshall) : [];
}

module.exports = { getUserDataForClient };

3. Validate and sanitize all inputs before building DynamoDB expressions

Never directly concatenate user input into expression attribute names or values. Use conditionals that compare server-validated identifiers and explicitly define which attributes can be projected.

// validation.js
const Joi = require('joi');

const userIdSchema = Joi.string().pattern(/^[a-zA-Z0-9_-]{1,64}$/);

function validateUserId(input) {
  const { error, value } = userIdSchema.validate(input);
  if (error) throw new Error('Invalid userId');
  return value;
}

module.exports = { validateUserId };

4. Avoid returning sensitive attributes in responses

Ensure that projection expressions exclude fields like apiKey, secret, or passwordHash. If you must use a broad scan for administrative tooling, restrict it to backend jobs with elevated IAM permissions and never expose it to public endpoints.

// admin-tools.js — backend only
const { ScanCommand } = require('@aws-sdk/client-dynamodb');

async function adminScanSecrets() {
  const params = {
    TableName: process.env.DYNAMODB_TABLE,
    ProjectionExpression: 'apiKey,secret'
  };
  const { Items } = await client.send(new ScanCommand(params));
  return Items;
}

// This function is never attached to public Fiber routes.

5. Configure logging to redact sensitive fields

Ensure structured logging does not capture API keys. If you must log for debugging, explicitly omit known sensitive attributes.

// logger.js
const pino = require('pino');
const logger = pino({ redact: { paths: ['apiKey', 'secret', 'password'], censor: '**REDACTED**' } });

module.exports = logger;