Arp Spoofing in Chi with Openid Connect

Arp Spoofing is a Layer 2 attack where an attacker sends falsified Address Resolution Protocol messages to associate their MAC address with the IP address of a legitimate host, typically the gateway or another API service in the network path. In Chi, a common .NET web framework, this can intersect with OpenID Connect (OIDC) when OIDC redirects and token handling occur over a local or LAN environment where ARP manipulation is feasible.

When Chi applications use OpenID Connect for authentication, the authorization flow involves redirecting the user agent to an identity provider (IdP), receiving an authorization code, and exchanging that code for tokens. If an attacker performs Arp Spoofing on the network segment hosting the Chi application or the IdP endpoint, they can intercept or modify HTTP traffic between the client and the Chi server or between the Chi server and the IdP. This becomes particularly relevant when the redirect URIs are served over HTTP (not recommended) or when internal network routing is misconfigured, allowing the attacker to sit in the path and observe or alter OIDC-related requests and responses.

The exposure arises because OIDC relies on accurate redirection and strict validation of state and nonce parameters. Arp Spoofing can facilitate a man-in-the-middle (MITM) scenario where an attacker intercepts the authorization code or tokens in transit. If the Chi application does not enforce transport layer security strictly (e.g., using HSTS and requiring HTTPS for all endpoints), the attacker might downgrade the connection or inject malicious content. Even when HTTPS is used, if certificate validation is not properly enforced in Chi (e.g., ignoring host mismatches or accepting any certificate in development configurations), the intercepted TLS session might appear valid to the client, allowing the attacker to proceed with token theft or session fixation.

Additionally, in a Chi application that hosts an OIDC client middleware, misconfigured endpoints or overly permissive CORS policies can compound the risk. For example, if the application accepts authorization responses from non-localhost origins without strict referrer checks, an attacker who successfully spoofs ARP and controls a nearby host might be able to relay or tamper with the callback. This does not directly break the cryptographic properties of OIDC but undermines the integrity of the network path, enabling token interception or substitution before the Chi middleware validates them.

To contextualize within the scan dimensions mentioned by middleBrick, Arp Spoofing maps primarily to the BFLA/Privilege Escalation and Data Exposure checks. The scanner tests whether tokens or sensitive session data can be observed or manipulated when an attacker is positioned on the same network segment. While middleBrick does not test Layer 2 attacks directly, it can detect outcomes such as missing transport security, improper redirect handling, or excessive data exposure in logs that result from a successfully executed Arp Spoofing scenario against an OIDC-enabled Chi application.

Remediation focuses on enforcing secure communication, strict validation, and proper configuration of the OIDC middleware in Chi. The following examples assume you are using the Microsoft.AspNetCore.Authentication.OpenIdConnect package with a typical ASP.NET Core host in Chi.

Enforce HTTPS and HSTS

Ensure all endpoints, especially the OIDC callback, are served over HTTPS and that HSTS is enabled to prevent protocol downgrade attacks.

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddHttpsRedirection(options =>
{
    options.HttpsPort = 443;
    options.RedirectStatusCode = StatusCodes.Status307TemporaryRedirect;
});
builder.Services.AddHsts(options =>
{
    options.MaxAge = TimeSpan.FromDays(365);
    options.IncludeSubDomains = true;
    options.Preload = true;
});
var app = builder.Build();
app.UseHttpsRedirection();
app.UseHsts();

Configure OpenID Connect with strict token validation

Set RequireHttpsMetadata to true for production, validate issuer and audience, and always validate the nonce and state to prevent token substitution or replay.

builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = "Cookies";
    options.DefaultChallengeScheme = "OpenIdConnect";
}).AddCookie("Cookies").AddOpenIdConnect("OpenIdConnect", options =>
{
    options.Authority = "https://your-identity-provider.com";
    options.ClientId = "your-client-id";
    options.ClientSecret = "your-client-secret";
    options.ResponseType = "code";
    options.SaveTokens = true;
    options.RequireHttpsMetadata = true;
    options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidIssuer = "https://your-identity-provider.com",
        ValidateAudience = true,
        ValidAudience = "your-client-id",
        ValidateLifetime = true,
        ClockSkew = TimeSpan.FromMinutes(5)
    };
    options.Events = new OpenIdConnectEvents
    {
        OnRedirectToIdentityProvider = context =>
        {
            // Ensure that the redirect is always over HTTPS
            if (!context.ProtocolMessage.RedirectUri.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
            {
                context.ProtocolMessage.RedirectUri = context.ProtocolMessage.RedirectUri.Replace("http://", "https://");
            }
            return Task.CompletedTask;
        },
        OnTokenValidated = context =>
        {
            // Additional checks, e.g., verify custom claims or nonce if used
            return Task.CompletedTask;
        }
    };
});

Validate referrer and origin for callback endpoints

Although OIDC callbacks are typically POSTed by the IdP, enforce strict origin checks if your application exposes any endpoints that might be influenced by external input related to authentication.

app.Use(async (context, next) =>
{
    if (context.Request.Path.StartsWithSegments("/signin-oidc"))
    {
        // Example: ensure referrer is from known IdP if applicable
        var referrer = context.Request.Headers.Referer.ToString();
        if (!string.IsNullOrWhiteSpace(referrer) && !referrer.Contains("your-identity-provider.com"))
        {
            context.Response.StatusCode = StatusCodes.Status403Forbidden;
            return;
        }
    }
    await next();
});

Use secure cookies and anti-forgery for session management

Protect the session established after OIDC authentication by configuring cookie policies that mitigate tampering and cross-site request forgery.

builder.Services.ConfigureApplicationCookie(options =>
{
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.Cookie.HttpOnly = true;
    options.Cookie.SameSite = SameSiteMode.Strict;
});

Scan and monitor with middleBrick

Use the middleBrick CLI to validate your configuration from the terminal: middlebrick scan <your-chi-api-url>. In CI/CD, integrate the GitHub Action to fail builds if the security score drops below your chosen threshold. For continuous monitoring, the Pro plan schedules scans and delivers alerts via Slack or Teams when findings such as missing HTTPS or improper redirect handling are detected.