Auth Bypass in Gorilla Mux with Cockroachdb

Auth bypass in a Gorilla Mux and Cockroachdb stack typically occurs when routing and authorization checks are misaligned with how database access is validated. Gorilla Mux is a powerful HTTP router that enables fine-grained route matching, but it does not enforce authentication or authorization on its own. If route-level protections are omitted or incorrectly applied, an attacker can reach endpoints that should be protected. Cockroachdb, as a distributed SQL database, enforces its own identity and permission model at the connection and SQL object level. When application code constructs database queries dynamically using URL parameters or headers without validating the requester’s scope, the combination creates a BOLA/IDOR-style auth bypass.

Consider a route like /org/{orgID}/users/{userID} handled by Gorilla Mux. If the handler retrieves the orgID from the route variables and directly interpolates it into a Cockroachdb query such as SELECT * FROM users WHERE org_id = $1, but skips verifying that the authenticated principal belongs to that org, the endpoint leaks data across organizational boundaries. Cockroachdb may return rows because the database user has broad permissions, and the application incorrectly trusts the route parameters. This is a BOLA (Broken Level of Authorization) pattern: the API exposes a reference to a resource without confirming the caller’s authorization to access it. The vulnerability is not in Cockroachdb itself, but in how the application uses the database without enforcing per-request authorization checks aligned with the router’s parameters.

Additionally, if the application relies on unauthenticated or weakly authenticated access to the API and exposes Cockroachdb-backed endpoints without validating tokens or session state in each handler, the router’s paths become entry points for unauthenticated data access. For example, missing middleware that validates a JWT before reaching the route allows an attacker to enumerate user IDs or org IDs by probing predictable identifiers. The database may not reject the query, and the response may include sensitive data, effectively bypassing authentication at the application layer despite Cockroachdb’s role as a secure backend store.

To secure a Gorilla Mux application using Cockroachdb, enforce authorization in handlers before constructing SQL statements, and use parameterized queries to avoid injection while ensuring row-level security aligns with the requester’s identity. Below is a concrete, secure pattern that binds route parameters to database permissions and validates the caller’s scope on every request.

// secure_handler.go
package main

import (
	"context"
	"net/http"
	"strconv"

	"github.com/gorilla/mux"
	"github.com/jackc/pgx/v5/pgxpool"
)

type AuthContextKey string

const userIDKey AuthContextKey = "userID"
const userOrgKey AuthContextKey = "userOrg"

// authMiddleware validates a bearer token and injects user org into context.
func authMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// In practice, validate JWT or session, extract subject and org.
		// For this example, we derive them from a header.
		userID, orgID, err := validateToken(r)
		if err != nil || userID == 0 || orgID == 0 {
			http.Error(w, "unauthorized", http.StatusUnauthorized)
			return
		}
		ctx := context.WithValue(r.Context(), userIDKey, userID)
		ctx = context.WithValue(ctx, userOrgKey, orgID)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

// validateToken is a stub; replace with real token parsing.
func validateToken(r *http.Request) (int64, int64, error) {
	header := r.Header.Get("Authorization")
	if header == "Bearer valid-org-1" {
		return 1001, 1, nil
	}
	return 0, 0, &invalidTokenError{}
}

// getUser is a secure handler that respects both route and DB permissions.
func getUser(pool *pgxpool.Pool) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		vars := mux.Vars(r)
		reqOrgID, err := strconv.ParseInt(vars["orgID"], 10, 64)
		if err != nil {
			http.Error(w, "bad request", http.StatusBadRequest)
			return
		}
		userOrg := r.Context().Value(userOrgKey).(int64)
		if reqOrgID != userOrg {
			http.Error(w, "forbidden", http.StatusForbidden)
			return
		}

		userID := r.Context().Value(userIDKey).(int64)
		var username string
		// Use parameterized query with explicit placeholders; Cockroachdb requires $1, $2, etc.
		row := pool.QueryRow(r.Context(),
			"SELECT username FROM users WHERE id = $1 AND org_id = $2",
			userID, reqOrgID)
		if err := row.Scan(&username); err != nil {
			http.Error(w, "not found", http.StatusNotFound)
			return
		}
		w.Write([]byte("User: " + username))
	}
}

// orgUsers lists users only within the caller’s org, using a parameterized query.
func orgUsers(pool *pgxpool.Pool) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		vars := mux.Vars(r)
		orgID, err := strconv.ParseInt(vars["orgID"], 10, 64)
		if err != nil {
			http.Error(w, "bad request", http.StatusBadRequest)
			return
		}
		// Ensure the request org matches the authenticated org.
		userOrg := r.Context().Value(userOrgKey).(int64)
		if orgID != userOrg {
			http.Error(w, "forbidden", http.StatusForbidden)
			return
		}

		rows, err := pool.Query(r.Context(),
			"SELECT id, username FROM users WHERE org_id = $1", orgID)
		if err != nil {
			http.Error(w, "server error", http.StatusInternalServerError)
			return
		}
		defer rows.Close()
		// Iterate and encode response securely.
		for rows.Next() {
			var id int64
			var username string
			if err := rows.Scan(&id, ¤tUsername); err != nil {
				http.Error(w, "server error", http.StatusInternalServerError)
				return
			}
			w.Write([]byte(username + "\n"))
		}
	}
}

func main() {
	pool, err := pgxpool.New(context.Background(), "postgres://localhost:26257/mydb?sslmode=disable")
	if err != nil {
		panic(err)
	}
	defer pool.Close()

	r := mux.NewRouter()
	r.Use(authMiddleware)
	r.HandleFunc("/org/{orgID}/users/{userID}", getUser(pool)).Methods("GET")
	r.HandleFunc("/org/{orgID}/members", orgUsers(pool)).Methods("GET")
	http.ListenAndServe(":8080", r)
}

The key remediation points are:

• Validate the requester’s org against the route’s orgID before issuing any Cockroachdb query.
• Use parameterized queries with $1, $2 placeholders to prevent SQL injection while ensuring the database receives typed arguments.
• Enforce row-level expectations: even if the database user has broad permissions, the application must restrict rows by org_id and primary key, preventing cross-org access.

middleBrick can support this posture by scanning the API endpoints and flagging missing authorization checks between the Gorilla Mux routes and Cockroachdb queries, providing findings aligned with OWASP API Top 10 and compliance mappings.