Broken Access Control with Api Keys

Broken Access Control in API keys often occurs when authorization checks are bypassed or improperly implemented. A common pattern involves missing validation of user permissions before processing requests. For example, an endpoint might retrieve a user record without verifying the requester has rights to access that specific resource.

app.get('/api/users/:id', (req, res) => {
  const userId = req.params.id;
  User.findById(userId, (err, user) => {
    if (err) return res.status(500).send(err);
    res.json(user); // No permission check!
  });
});

This endpoint exposes any user's data simply by knowing their ID. The server trusts the client to request only authorized data, which violates the principle of least privilege. Attackers can enumerate user IDs and extract sensitive information.

Another manifestation involves API key exposure through client-side code or public repositories. Developers sometimes commit API keys to GitHub, exposing them to anyone who finds the repository. Even when keys aren't directly exposed, insufficient rate limiting allows attackers to brute force or enumerate resources.

Time-based access control bypasses also occur when expiration checks are missing or improperly implemented. An API might accept a key without verifying whether it's still valid, allowing expired keys to function indefinitely.

Cross-tenant data leakage represents another critical failure. Multi-tenant applications must ensure users cannot access data from other tenants. When tenant isolation fails, users can manipulate request parameters to access another tenant's data.

// Vulnerable multi-tenant pattern
app.get('/api/tenant/:tenantId/data', (req, res) => {
  const tenantId = req.params.tenantId;
  Data.find({ tenantId: tenantId }, (err, data) => {
    res.json(data); // No check that user belongs to this tenant
  });
});

Role-based access control (RBAC) bypasses frequently occur when role checks are missing or can be manipulated. An attacker might modify a role field in a request to escalate privileges, especially if the server trusts client-side role information.

Detecting broken access control in API keys requires systematic testing of authorization boundaries. Manual testing involves attempting to access resources with different user accounts, modifying user IDs in requests, and testing with expired or invalid keys.

Automated scanning with middleBrick provides comprehensive coverage. The scanner tests authentication bypass attempts, attempts to access restricted endpoints with different authorization levels, and verifies that rate limiting prevents enumeration attacks.

middleBrick's BOLA (Broken Object Level Authorization) checks specifically target IDOR vulnerabilities by testing whether users can access objects they shouldn't own. For API keys, this includes testing whether keys from one user can access another user's resources.

The scanner also tests privilege escalation by attempting to modify request parameters that control access levels, such as user roles or tenant IDs. It verifies that property authorization is properly enforced at the field level, not just the object level.

Key detection patterns include:

• Missing authorization checks before database queries
• Direct object references without permission validation
• Insecure direct object references (IDOR) vulnerabilities
• Cross-tenant data access without tenant verification
• Role manipulation vulnerabilities
• Time-based access control bypasses

middleBrick's black-box scanning approach tests the actual runtime behavior without requiring source code access. It sends crafted requests to identify authorization failures that might not be visible through code review alone.

For API keys specifically, the scanner tests whether keys can be reused across different user contexts, whether key rotation is properly enforced, and whether key scopes are properly validated against requested operations.

Remediating broken access control in API keys requires implementing proper authorization checks throughout the application. The first step is establishing a consistent authorization pattern that validates permissions before any data access.

// Secure pattern with proper authorization
app.get('/api/users/:id', authenticate, authorize, (req, res) => {
  const userId = req.params.id;
  
  // Verify requester has permission to access this user
  if (!req.user.canAccessUser(userId)) {
    return res.status(403).json({ error: 'Access denied' });
  }
  
  User.findById(userId, (err, user) => {
    if (err) return res.status(500).send(err);
    res.json(user);
  });
});

Implementing role-based access control with middleware ensures consistent permission checks. Each endpoint should verify the requester's permissions before processing.

function authorize(permission) {
  return (req, res, next) => {
    if (!req.user || !req.user.permissions.includes(permission)) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    next();
  };
}

// Usage
app.get('/api/admin/users', authenticate, authorize('admin:users:list'), (req, res) => {
  User.find({}, (err, users) => {
    res.json(users);
  });
});

For multi-tenant applications, tenant isolation must be enforced at the data access layer. Each query should automatically filter by the current tenant ID.

function withTenantFilter(req, query) {
  if (req.user.tenantId) {
    query.where('tenantId', req.user.tenantId);
  }
  return query;
}

app.get('/api/tenant/data', authenticate, (req, res) => {
  const query = withTenantFilter(req, Data.find());
  query.exec((err, data) => {
    if (err) return res.status(500).send(err);
    res.json(data);
  });
});

API key management should include proper expiration, rotation, and scope limitations. Keys should have the minimum necessary permissions and be rotated regularly.

// Key validation middleware
function validateApiKey(req, res, next) {
  const apiKey = req.headers['x-api-key'];
  
  if (!apiKey) {
    return res.status(401).json({ error: 'API key required' });
  }
  
  ApiKey.findOne({ key: apiKey }, (err, key) => {
    if (err || !key || key.expired) {
      return res.status(401).json({ error: 'Invalid or expired API key' });
    }
    
    // Check if key has permission for this endpoint
    if (!key.scopes.includes(req.endpointScope)) {
      return res.status(403).json({ error: 'Insufficient key permissions' });
    }
    
    req.apiKey = key;
    next();
  });
}

Input validation prevents parameter manipulation attacks. Never trust client-provided IDs or role information.

app.get('/api/users/:id', authenticate, (req, res) => {
  const userId = req.params.id;
  
  // Validate that user is requesting their own data or has admin rights
  if (userId !== req.user.id && !req.user.isAdmin) {
    return res.status(403).json({ error: 'Cannot access other users' });
  }
  
  User.findById(userId, (err, user) => {
    if (err || !user) return res.status(404).send(err);
    res.json(user);
  });
});