Api Rate Abuse in Chi with Basic Auth

Rate abuse in the Chi web framework when using HTTP Basic Authentication arises from the interaction between per-route or per-identity limits and the way credentials are handled in each request. Without explicit enforcement, an attacker can open many connections or send many requests using the same or many stolen credentials, consuming server-side resources and potentially degrading availability for legitimate users.

Chi routes typically identify a user via a token or username extracted from the Authorization header. If rate limiting is applied only at a coarse global level or omitted entirely, an attacker authenticating with a valid credential can issue a high volume of authenticated requests. This authenticated flood counts against the identity tied to the credentials, which may bypass IP-based limits and makes detection harder when logs are aggregated by user rather than by source address.

Another vector arises from how Basic Auth credentials are transmitted and validated on each request. Because the credentials are base64-encoded (not encrypted) and sent with every call, an attacker who knows or guesses a credential can repeatedly authenticate within the same time window. If the server does not bind rate limits to the parsed user identity and does not differentiate between authenticated successes and failures, an unauthenticated attacker can iterate through common credentials while staying under IP-level thresholds.

Chi’s lightweight nature means developers must explicitly add middleware for throttling. Missing or misconfigured middleware allows bursts that exhaust thread pools, database connections, or downstream service quotas. For example, an endpoint that performs a database lookup after verifying Basic Auth can be overwhelmed by concurrent authenticated calls, leading to contention, timeouts, or error spikes that constitute a denial-of-service condition.

Consider an authenticated admin endpoint that does not enforce per-username limits:

import cats.effect.IO
import org.http4s._
import org.http4s.dsl.io._
import org.http4s.server.middleware.RateLimiter
import scala.concurrent.duration._

val apiKeyRateLimit = RateLimiter[IO](100, 1.minute) // global, not per user

val adminRoute = HttpRoutes.of[IO] {
  case req @ POST -> Root / "admin" / "reset" =>
    // Vulnerable: uses global rate limiter; does not scope by user identity from Basic Auth
    adminResetService(req).handleError(_ => InternalServerError())
}.orNotFound

In the snippet above, the global limiter does not map requests to the user encoded in the Basic Auth header. An attacker with one credential can still saturate the admin endpoint because the limiter is shared across all authenticated requests.

To detect this during a scan, middleBrick checks whether authenticated endpoints have per-identity or per-key rate limiting and whether failures and successes are tracked separately. Findings include missing user-bound throttling, inconsistent enforcement across routes, and lack of differentiation between authentication outcomes, all of which increase the risk of authenticated denial-of-service via rate abuse.

Remediation focuses on scoping rate limits to the authenticated identity and ensuring validation happens before expensive operations. Use middleware that extracts the user principal from the Basic Auth credential and applies a dedicated rate limit per identity, while also maintaining a global cap to protect server resources.

Below is a concrete, working example that combines Basic Auth validation with per-user rate limiting in Chi using http4s and a token-bucket implementation:

import cats.effect._
import org.http4s._
import org.http4s.dsl.io._
import org.http4s.server._
import org.http4s.server.middleware._
import scala.concurrent.duration._

// A simple in-memory rate store keyed by user identifier
class RateStore[F[_]: Sync] {
  private val store = collection.mutable.Map.empty[String, (Int, Long)]
  def allow(userId: String, limit: Int, window: FiniteDuration): F[Boolean] = Sync[F].delay {
    val now = System.currentTimeMillis()
    store.get(userId) match {
      case Some((count, ts)) if now - ts < window.toMillis =>
        if (count < limit) { store.update(userId, (count + 1, ts)); true } else false
      case _ =>
        store.update(userId, (1, now))
        true
    }
  }
  def cleanupExpired(window: FiniteDuration): F[Unit] = Sync[F].delay {
    val cutoff = System.currentTimeMillis() - window.toMillis
    store.filterInPlace { case (_, (_, ts)) => ts >= cutoff }
  }
}

object RateLimitMiddleware {
  def apply[F[_]: Sync](store: RateStore[F], limit: Int, window: FiniteDuration)(routes: HttpRoutes[F]): HttpRoutes[F] = { rs =>
    rs.flatMap { req =>
      req.headers.get(org.http4s.headers.`Authorization`).flatMap { auth =>
        auth.token match {
          case scheme if scheme.startsWith("Basic ") =>
            val cred = new String(java.util.Base64.getDecoder.decode(scheme.substring(6)))
            val parts = cred.split(":", 2)
            if (parts.length == 2) {
              val (user, _) = (parts(0), parts(1))
              store.allow(user, limit, window).flatMap { granted =>
                if (granted) routes.orNotFound(req) else Forbidden("Rate limit exceeded")
              }
            } else Unauthorized()
          case _ => Unauthorized()
        }
      }.getOrElse(Unauthorized())
    }
  }
}

val store = new RateStore[IO]
val userRateLimit = RateLimitMiddleware(store, 30, 1.minute)

val apiRoutes = HttpRoutes.of[IO] {
  case GET -> Root / "data" => Ok("authenticated data")
}.orNotFound

val httpApp = userRateLimit(apiRoutes)

This example decodes the Basic Auth credential on each request, extracts the user identifier, and applies a per-user token-bucket algorithm. It ensures that even if an attacker possesses a valid credential, they cannot exceed 30 requests per minute, protecting the endpoint from authenticated floods.

Additional hardening includes enforcing TLS to protect credentials in transit, adding short-lived credentials, and monitoring for repeated authentication failures to detect credential-stuffing attempts. middleBrick validates that per-identity rate limits are present for authenticated routes and flags endpoints that rely only on global or IP-based limits.