Api Key Exposure in Gorilla Mux with Oauth2

Gorilla Mux is a popular HTTP router for Go that supports route matching and middleware integration. When combined with OAuth 2.0, a common pattern is to use API keys as an additional credential for authorization or to identify clients before token validation. If API keys are handled inconsistently—such as being passed in URLs, query parameters, or non-encrypted headers—they can be inadvertently exposed in logs, referrer headers, or error messages.

OAuth 2.0 introduces multiple flows (authorization code, client credentials, implicit) and relies on bearer tokens. When API keys are used alongside bearer tokens without strict transport protections, the key may be stored or transmitted in plaintext. For example, logging the incoming request URL for debugging purposes can capture query parameters containing keys. Gorilla Mux route definitions that capture path variables without enforcing HTTPS can also lead to leakage if requests are downgraded or intercepted.

The risk is compounded when middleware extracts the API key from the request and passes it in headers or context without redaction. If the OAuth 2.0 introspection endpoint or resource server logs the full request—including headers containing keys—keys may appear in observability tooling. Additionally, misconfigured CORS or referrer policies in frontend applications that call the Gorilla Mux backend can cause the browser to include API keys in Referer headers, exposing them to third-party origins.

Because middleBrick scans the unauthenticated attack surface, it can detect endpoints where API keys are accepted via query parameters or exposed in error responses. The scan checks for data exposure patterns such as keys reflected in responses or missing transport encryption, even when OAuth 2.0 is used for authentication. This helps identify whether sensitive credentials are handled safely in the request lifecycle.

To mitigate API key exposure while using OAuth 2.0 with Gorilla Mux, enforce strict transport security, avoid exposing keys in logs, and isolate key usage from token validation. Below are specific remediation steps with code examples.

1. Enforce HTTPS and secure headers

Ensure all requests use HTTPS and set security headers to prevent leakage via Referer or other channels.

package main

import (
    "net/http"
    "github.com/gorilla/mux"
    "github.com/gorilla/handlers
)

func main() {
    r := mux.NewRouter()
    r.HandleFunc("/api/resource", func(w http.ResponseWriter, r *http.Request) {
        // handler logic
    })

    // Enforce HTTPS and set security headers
    secureHeaders := handlers.HeadersMiddlewareFunc(func(h http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
            w.Header().Set("Referrer-Policy", "no-referrer")
            w.Header().Set("X-Content-Type-Options", "nosniff")
            h.ServeHTTP(w, r)
        })
    })

    http.ListenAndServeTLS(":443", "server.crt", "server.key", secureHeaders(r))
}

2. Avoid query parameters for API keys

Do not accept API keys as query parameters. Use headers instead and validate presence before routing.

func apiKeyMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        apiKey := r.Header.Get("X-API-Key")
        if apiKey == "" {
            http.Error(w, "missing X-API-Key header", http.StatusUnauthorized)
            return
        }
        // Optionally validate key format or check against a store
        ctx := context.WithValue(r.Context(), "apiKey", apiKey)
        next.ServeHTTP(w, r.WithContext(ctx))
    })
}

func main() {
    r := mux.NewRouter()
    r.Use(apiKeyMiddleware)
    r.HandleFunc("/api/data", dataHandler).Methods("GET")
    http.ListenAndServe(":8080", r)
}

3. Isolate OAuth 2.0 token validation from key handling

Validate OAuth 2.0 tokens separately and avoid mixing token introspection with API key checks. Use the token for authorization decisions and the key for operational identification only when necessary.

func oauthMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        authHeader := r.Header.Get("Authorization")
        if authHeader == "" {
            http.Error(w, "missing Authorization header", http.StatusUnauthorized)
            return
}
        // Validate Bearer token format (e.g., introspect via OAuth 2.0 introspection endpoint)
        // This example assumes a helper validateToken exists
        if !validateToken(authHeader) {
            http.Error(w, "invalid token", http.StatusForbidden)
            return
        }
        next.ServeHTTP(w, r)
    })
}

func validateToken(auth string) bool {
    // Implement OAuth 2.0 introspection or JWT validation here
    return true
}

4. Centralize logging to prevent key leakage

Ensure logs do not capture query parameters or headers containing API keys. Redact sensitive fields before logging.

func safeLogger(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        // Avoid logging raw URL or query
        // Use structured logging with redacted fields
        logRequest(r)
        next.ServeHTTP(w, r)
    })
}

func logRequest(r *http.Request) {
    // Example: log method and path without query
    // In production, use a logging library that supports redaction
}

5. Use Gorilla Mux middleware for consistent route handling

Combine security middleware to ensure each request enforces HTTPS, validates API keys in headers, and validates OAuth 2.0 tokens before reaching business logic.

func main() {
    r := mux.NewRouter()
    r.HandleFunc("/api/secure", secureHandler).Methods("GET")

    chain := handlers.CompressHandler(
        safeLogger(
            apiKeyMiddleware(
                oauthMiddleware(r),
            ),
        ),
    )
    http.ListenAndServeTLS(":443", "server.crt", "server.key", chain)
}