Arp Spoofing in Grape with Bearer Tokens

Arp spoofing is a link-layer attack where an attacker sends falsified ARP messages to associate their MAC address with the IP address of another host, typically the default gateway. In a Grape API service that relies on Bearer Tokens for authorization, arp spoofing can expose tokens in transit even when the application uses HTTPS.

Consider a Grape API mounted at /api. If an attacker successfully spoofs the gateway or another host on the same local network, they can intercept HTTP requests before they reach the TLS layer. Because the request still includes the Authorization header (e.g., Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6...), the attacker can capture the token if the environment does not enforce strict host-key validation or if other layers (e.g., proxies) terminate TLS differently. The token itself is not inherently vulnerable due to being a bearer credential, but the network path between client and API becomes untrustworthy when arp spoofing is possible.

This risk is particularly relevant in shared or uncontrolled environments (e.g., internal networks, CI runners, containers on the same bridge). Even with Bearer Tokens, without additional protections like mutual TLS or strict network segmentation, an attacker who wins the ARP race can observe and replay intercepted requests, escalating from network eavesdropping to unauthorized API access.

Because middleBrick scans the unauthenticated attack surface, it tests categories such as SSRF and Transport Security and flags environments where token-bearing traffic could be exposed on insecure paths. Findings include evidence of weak network controls and guidance to harden deployment topology, rather than implying that Bearer Tokens are flawed by design.

Remediation focuses on ensuring Bearer Tokens are never exposed on insecure paths and that the API enforces strict transport and host verification. Below are concrete Grape-oriented practices and code examples.

1. Enforce HTTPS for all API routes

Redirect any HTTP requests to HTTPS and reject insecure calls. In Grape, you can enforce this at the API class level.

class API::V1 < Grape::API
  format :json

  before do
    unless request.ssl? || ENV['RACK_ENV'] == 'test'
      error!({ error: 'HTTPS required' }, 403)
    end
  end

  resource :users do
    desc 'Get current user profile'
    params do
      requires :authorization, type: String, desc: 'Bearer token'
    end
    get :profile do
      # token usage handled by downstream auth logic
    end
  end
end

2. Validate Host and Referer headers

Add checks to ensure requests target the intended hostname and, where applicable, originate from an expected referrer. This complements transport security and reduces the impact of a compromised local network.

class API::V1 < Grape::API
  format :json

  before do
    allowed_hosts = ['api.example.com', 'api-staging.example.com']
    unless allowed_hosts.include?(request.host)
      error!({ error: 'Host not allowed' }, 403)
    end

    # Optional strict referer check for browser-originated calls
    referer = request.env['HTTP_REFERER']
    if referer && !referer.start_with?('https://app.example.com')
      error!({ error: 'Invalid referer' }, 403)
    end
  end
end

3. Use secure, HttpOnly cookies when storing tokens client-side

If your frontend stores Bearer Tokens in cookies rather than in JavaScript-accessible storage, set Secure and HttpOnly flags to mitigate exposure via XSS and network interception. This does not prevent arp spoofing but limits the token surface.

# config/initializers/session_store.rb (if using Rails-backed Grape)Rails.application.config.session_store :cookie_store, key: '_api_session', secure: Rails.env.production?, httponly: true, same_site: :strict

4. Apply short token lifetimes and rotation

Short-lived Bearer Tokens reduce the window for replay after a token is intercepted. Implement token refresh mechanisms and ensure your authorization logic validates scopes and expiry rigorously.

# Example token validation within a Grape route helper
def current_user
  token = request.env['HTTP_AUTHORIZATION']&.split(' ')&.last
  return nil unless token

  begin
    decoded = JWT.decode(token, ENV['JWT_SECRET'], true, { algorithm: 'HS256' })
    @current_user = User.find(decoded.first['sub'])
  rescue JWT::ExpiredSignature
    error!({ error: 'Token expired' }, 401)
  rescue JWT::DecodeError
    error!({ error: 'Invalid token' }, 401)
  end
end

5. Network-level mitigations

While not code changes, these are essential to complement the above: enforce ARP inspection on switches, use port security, and isolate API traffic via VLANs. These reduce the feasibility of arp spoofing in the first place.

middleBrick’s findings around SSRF and Transport Security can highlight environments where these controls are missing, enabling prioritized remediation.