Api Key Exposure in Strapi with Hmac Signatures

Strapi is a headless CMS that often exposes REST or GraphQL endpoints which, by default, do not enforce authentication for read operations. When developers add Hmac Signatures to secure these endpoints, they sometimes inadvertently expose API keys or secrets through implementation mistakes, client-side code, or insecure transport. A common pattern is to use a static secret and a predictable key identifier embedded in query parameters or headers, which can be discovered through unauthenticated scanning.

Consider an endpoint like /api/contents that relies on Hmac Signatures for integrity. If the client-side JavaScript includes both the public key identifier and the algorithm parameters, an attacker can harvest the key identifier from the source. While the secret itself should remain server-side, misconfigured CORS or overly permissive preflight responses can allow an attacker to enumerate valid key identifiers. middleBrick tests for these exposures as part of its Data Exposure and Unsafe Consumption checks, flagging endpoints where key identifiers are leaked in responses or error messages.

Hmac Signatures typically require the client to compute a hash using a shared secret, a timestamp, and a nonce. If Strapi applications log request details—including query strings and headers—without redacting the signature or secret-related parameters, keys may be written to log files accessible to unauthorized parties. The signature itself may be transmitted in an HTTP header such as x-api-signature, and if the server returns detailed errors that include the expected format, an attacker can infer valid patterns. middleBrick’s LLM/AI Security checks include Output scanning for API keys, detecting whether signatures or secrets appear in error payloads or verbose responses, which can indicate unsafe logging or exception handling.

Another vector involves replay attacks where a valid Hmac-signed request is captured and reused. If Strapi does not enforce strict timestamp windows or nonce validation, an attacker can reuse a request with a static API key identifier to access data. middleBrick tests for Rate Limiting and BFLA/Privilege Escalation to see whether requests with identical signatures are accepted after the intended time window. Without proper replay protection, even correctly implemented Hmac Signatures can lead to unauthorized data access through reused requests bearing exposed key identifiers.

The combination of unauthenticated endpoints, verbose error handling, and improper secret management creates conditions where API key exposure occurs not through direct secret leakage, but through inference, logging, and weak replay controls. By running a scan against a Strapi instance, middleBrick validates whether key identifiers are safely isolated, whether signatures are transmitted over encrypted channels, and whether responses avoid disclosing implementation details that could aid an attacker in deriving or reusing Hmac values.

To mitigate API key exposure when using Hmac Signatures in Strapi, focus on keeping the shared secret server-side, ensuring safe transport, and hardening the validation logic. Below are concrete code examples for Strapi controllers and middleware that demonstrate secure Hmac handling.

Secure Hmac Signature Generation and Verification

On the client side, compute the signature using the payload, timestamp, and a nonce, but do not embed the secret. The secret must remain in a server-side environment variable. Here is an example of client-side preparation (JavaScript) that sends only the public key identifier, timestamp, nonce, and signature:

// client-side preparation (do not include secret here)
const crypto = require('crypto');

function prepareSignedRequest(payload, publicKeyId) {
  const timestamp = Date.now().toString();
  const nonce = require('crypto').randomBytes(16).toString('hex');
  const message = `${timestamp}:${nonce}:${JSON.stringify(payload)}`;
  // WARNING: secret must NOT be accessible client-side
  // This example shows what should NOT be done
  throw new Error('Secret must not be used client-side');
}

Instead, perform signing on the server within a Strapi controller, using environment variables for the secret:

// server-side Strapi controller (e.g., api/content/controllers/content.js)
const crypto = require('crypto');

module.exports = {
  async generateSignedEndpoint(ctx) {
    const secret = process.env.HMAC_SECRET; // stored securely
    const timestamp = Date.now().toString();
    const nonce = crypto.randomBytes(16).toString('hex');
    const payload = ctx.request.body || {};
    const message = `${timestamp}:${nonce}:${JSON.stringify(payload)}`;
    const signature = crypto.createHmac('sha256', secret).update(message).digest('hex');

    ctx.body = {
      data: payload,
      meta: {
        timestamp,
        nonce,
        signature,
        keyId: 'prod-key-01',
      },
    };
  },
};

On the receiving endpoint, validate the signature safely and enforce short timestamp windows to prevent replay:

// server-side verification middleware in Strapi (e.g., api/content/middleware/verify-hmac.js)
const crypto = require('crypto');

module.exports = (config) => {
  return async (ctx, next) => {
    const signature = ctx.request.headers['x-api-signature'];
    const timestamp = ctx.request.headers['x-api-timestamp'];
    const nonce = ctx.request.headers['x-api-nonce'];
    const currentTime = Date.now();
    const timeWindow = 30000; // 30 seconds

    if (!signature || !timestamp || !nonce) {
      ctx.status = 400;
      ctx.body = { error: 'Missing signature components' };
      return;
    }

    if (Math.abs(currentTime - parseInt(timestamp, 10)) > timeWindow) {
      ctx.status = 401;
      ctx.body = { error: 'Request expired' };
      return;
    }

    const secret = process.env.HMAC_SECRET;
    const message = `${timestamp}:${nonce}:${JSON.stringify(ctx.request.body)}`;
    const expected = crypto.createHmac('sha256', secret).update(message).digest('hex');

    if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
      ctx.status = 401;
      ctx.body = { error: 'Invalid signature' };
      return;
    }

    await next();
  };
};

Additionally, configure Strapi to require HTTPS and avoid logging sensitive header values. Use environment variables for the HMAC secret and rotate keys periodically. middleBrick’s Pro plan supports continuous monitoring and can alert you if key identifiers appear in responses or if endpoints lack proper replay protection, helping you maintain a strong security posture without manual audits.