Arp Spoofing in Hanami with Bearer Tokens

Arp spoofing is a Layer 2 network attack where an attacker sends falsified Address Resolution Protocol messages to associate their MAC address with the IP address of a legitimate host, typically the default gateway. In a Hanami web application that relies on Bearer Tokens for authentication, this combination creates a critical exposure when token transmission occurs over a locally reachable network segment without additional protections.

Bearer Tokens are typically sent in the Authorization header as Authorization: Bearer <token>. If an attacker successfully performs arp spoofing between the client and the server, they can intercept HTTP traffic and capture these Authorization headers. Because Bearer Tokens are static credentials until expiration, intercepted tokens can be reused to impersonate the victim user or escalate abuse across the API. Hanami applications that do not enforce transport integrity beyond the initial TLS handshake remain vulnerable even after authentication, as arp spoofing operates below the TLS layer and can precede or coincide with the token exchange.

The risk is compounded when Hanami services are deployed in shared or flat network environments such as cloud VPCs with misconfigured security groups, local development networks, or containers on the same subnet. In such settings, arp spoofing is often trivial to execute using tools like arpspoof, and the attacker can silently relay or modify unencrypted HTTP requests that carry Bearer Tokens. Even if TLS is used, a client that fails to validate certificates properly can still be compromised at the network layer before TLS negotiation completes. Therefore, the combination of arp spoofing and Bearer Tokens in Hanami highlights the need for strict network segmentation, consistent use of TLS, and additional application-layer protections to limit token exposure and impact.

Remediation focuses on ensuring Bearer Tokens are never exposed to network-layer attacks like arp spoofing and are handled securely within the Hanami application. The primary defense is to enforce HTTPS for all endpoints, preventing token interception at the network level. Additionally, minimize the scope and lifetime of tokens and avoid embedding them in URLs or logs.

In Hanami, you can enforce secure token handling in the application configuration and request pipeline. For example, ensure that the application only serves over TLS and sets secure defaults for cookies and headers:

# config/environments/production.rb
Hanami.configure do
  # Force SSL for all requests, ensuring Bearer Tokens are transmitted only over HTTPS
  force_ssl true

  # Use secure and http_only flags for any session cookies
  session do
    cookie do |cookie|
      cookie.secure = true
      cookie.http_only = true
    end
  end
end

When validating and using Bearer Tokens, prefer extracting them from the Authorization header and avoiding query parameters. Here is a secure pattern for authenticating requests in a Hanami controller:

# app/controllers/application_controller.rb
class ApplicationController < Hanami::Controller
  before_action :authenticate_with_bearer_token

  private

  def authenticate_with_bearer_token
    auth_header = request.headers['Authorization']
    unless auth_header&.start_with?('Bearer ')
      halt 401, { error: 'Unauthorized' }.to_json
    end

    token = auth_header.split(' ').last
    # Validate token via a secure service or library
    unless TokenVerifier.valid?(token)
      halt 401, { error: 'Invalid token' }.to_json
    end

    # Store minimal user context, avoiding token leakage in logs
    @current_user = User.find_by_token(token)&.without_sensitive_data
  end
end

On the client side, ensure Bearer Tokens are stored securely and transmitted only over HTTPS. For JavaScript clients, avoid storing tokens in localStorage; prefer in-memory storage or secure, httpOnly cookies set by a trusted authentication service. Example fetch usage:

// Secure token transmission in a frontend client
fetch('https://api.yourapp.com/v1/resource', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer ' + getAccessToken(), // getAccessToken from secure in-memory store
    'Content-Type': 'application/json'
  },
  credentials: 'omit' // Avoid sending cookies unless necessary
}).then(response => {
  if (!response.ok) throw new Error('Unauthorized');
  return response.json();
});

Complementary measures include short token lifetimes, rotation, and binding tokens to specific client attributes (e.g., IP fingerprinting when appropriate). These steps reduce the window of opportunity for an attacker who may have compromised network-level integrity via arp spoofing.