Arp Spoofing in Express with Api Keys

Arp spoofing is a Layer 2 attack where an attacker sends falsified ARP messages to associate their MAC address with the IP address of a legitimate host, such as an API server or gateway. In an Express application that relies on API keys passed in HTTP headers, arp spoofing can enable an attacker to intercept or manipulate traffic without needing to compromise the application logic directly.

When API keys are transmitted over a local network that is vulnerable to arp spoofing, an attacker on the same network segment can redirect traffic between the client and the Express server. Even though API keys are typically validated by the server, the interception itself can expose sensitive data in transit if other protections (such as TLS) are absent or misconfigured. For example, an attacker may use tools like arpspoof to poison the ARP cache of a client device, causing the client’s requests meant for the Express API host to be sent to the attacker’s machine.

This combination is particularly risky when the Express service is deployed in environments where network segmentation is weak, such as shared office networks or cloud instances on the same subnet. The attacker does not need to exploit the Express application itself; they exploit the network path. If the intercepted requests include valid API keys, the attacker may be able to replay those keys in crafted requests to the Express server, provided there are no additional protections like request signatures, nonces, or strict rate limiting that could detect the anomaly.

While API keys are not secrets in the cryptographic sense—because they must be shared with clients to authorize requests—exposing them through an unverified network path can lead to unauthorized use. The risk is amplified if API keys are long-lived or lack scope restrictions, as intercepted keys can be reused across sessions. Insecure transmission, even within a trusted-looking local network, is a critical consideration when designing authorization schemes around API keys in Express applications.

It is important to note that middleBrick detects security issues such as missing transport protections and insecure authentication patterns during scans. The tool performs unauthenticated black-box testing and evaluates the API surface, including checks related to encryption and input validation, which can highlight environments susceptible to interception or manipulation.

Securing Express APIs that use API keys requires both network-level safeguards and application-level practices to reduce the impact of interception risks like arp spoofing. The following examples demonstrate concrete remediation steps, including enforced HTTPS, header-based key validation, and anti-replay considerations.

First, always enforce HTTPS to prevent plaintext transmission of API keys. Even if arp spoofing occurs, encryption in transit prevents the attacker from reading or modifying the keys. Below is an example of an Express server that redirects HTTP to HTTPS and validates API keys present in the x-api-key header:

const express = require('express');
const httpsRedirect = require('express-http2-secure-redirect')();
const app = express();

// Enforce HTTPS
app.use(httpsRedirect);

// List of valid API keys (in production, store these securely, e.g., in environment variables)
const VALID_API_KEYS = new Set([
  process.env.API_KEY_PROD,
  process.env.API_KEY_STAGING
].filter(Boolean));

// API key validation middleware
function validateApiKey(req, res, next) {
  const apiKey = req.header('x-api-key');
  if (!apiKey || !VALID_API_KEYS.has(apiKey)) {
    return res.status(401).json({ error: 'Unauthorized: Invalid or missing API key' });
  }
  next();
}

// Apply to protected routes
app.get('/api/resource', validateApiKey, (req, res) => {
  res.json({ data: 'secure data' });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});

To further mitigate the risk of replayed intercepted keys, consider coupling API keys with additional context, such as IP allowlisting or short-lived tokens. While API keys alone cannot prevent arp spoofing, combining them with transport security and strict access controls reduces the attack surface significantly.

For broader protection across multiple services, middleBrick’s Pro plan supports continuous monitoring and can be integrated into CI/CD pipelines via the GitHub Action to fail builds if security scores drop. The CLI can also be used locally to scan endpoints and verify that encryption and authentication checks are aligned with best practices.