Cors Wildcard in Chi

CORS wildcard misconfigurations in Chi applications create critical security vulnerabilities by allowing any origin to access API endpoints. This manifests through several attack vectors specific to Chi's middleware architecture.

The most common pattern involves setting the Access-Control-Allow-Origin header to "*" without proper validation. In Chi, this often appears in global middleware that applies CORS to all routes:

r := chi.NewRouter()
r.Use(middleware.CORS(middleware.AllowedOrigins([]string{"*"})))

This configuration permits any website to make cross-origin requests to your Chi API, enabling attackers to bypass same-origin policies. The vulnerability becomes severe when combined with Chi's route-specific middleware, where authenticated endpoints might inadvertently expose sensitive data to external domains.

Another manifestation occurs when developers use Chi's middleware.AllowedHeaders with overly permissive settings. A typical insecure pattern:

r.Use(middleware.CORS(middleware.AllowedOrigins([]string{"*"}),
    middleware.AllowedHeaders([]string{"*"}),
    middleware.AllowCredentials(true)))

This combination is particularly dangerous because browsers will include credentials (cookies, HTTP auth) with cross-origin requests when AllowCredentials is true, but the wildcard origin prevents the browser from enforcing proper CORS security checks.

Chi-specific route handlers can also introduce CORS wildcard issues. Consider an endpoint that returns user data:

r.Get("/api/user/{id}", func(w http.ResponseWriter, r *http.Request) {
    userID := chi.URLParam(r, "id")
    user, err := getUser(userID)
    if err != nil {
        http.Error(w, err.Error(), http.StatusNotFound)
        return
    }
    
    // Vulnerable: no origin validation
    w.Header().Set("Access-Control-Allow-Origin", "*")
    json.NewEncoder(w).Encode(user)
})

This pattern allows any website to enumerate user IDs and retrieve sensitive profile information, creating a classic BOLA (Broken Object Level Authorization) vulnerability when combined with CORS wildcard.

Detecting CORS wildcard vulnerabilities in Chi applications requires both manual code review and automated scanning. Start by examining your middleware stack for wildcard origins:

// Search for these patterns:
middleware.CORS(middleware.AllowedOrigins([]string{"*"}))
middleware.AllowedOrigins([]string{"*"})
w.Header().Set("Access-Control-Allow-Origin", "*")

middleBrick's API security scanner specifically detects CORS wildcard misconfigurations in Chi applications through black-box testing. The scanner sends cross-origin requests with various origins and analyzes the response headers to identify wildcard configurations.

For Chi applications, middleBrick tests:

• Whether endpoints respond to cross-origin requests from arbitrary domains
• If Access-Control-Allow-Credentials is enabled alongside wildcard origins
• Whether sensitive endpoints (authentication, user data) are exposed via CORS
• Cross-origin request smuggling attempts that exploit Chi's routing logic

middleBrick's CLI tool makes this detection process straightforward:

middlebrick scan https://api.yourservice.com --profile chi --output json

The scanner's Chi-specific profile includes tests for common Chi middleware patterns and their CORS implications. It identifies endpoints that should be protected but are inadvertently exposed through CORS misconfigurations.

Additional detection methods include:

// Runtime detection middleware for Chi
func corsAuditMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        origin := r.Header.Get("Origin")
        if origin != "" && origin != "null" {
            // Log suspicious cross-origin requests
            log.Printf("CORS request from %s to %s", origin, r.URL.Path)
            
            // Check if response includes wildcard CORS headers
            if w.Header().Get("Access-Control-Allow-Origin") == "*" {
                log.Printf("WARNING: Wildcard CORS detected on %s", r.URL.Path)
            }
        }
        next.ServeHTTP(w, r)
    })
}

This middleware helps identify active exploitation attempts by logging cross-origin requests that trigger wildcard CORS responses.

Remediating CORS wildcard vulnerabilities in Chi requires a defense-in-depth approach that validates origins and restricts exposed functionality. The primary fix involves replacing wildcard origins with explicit origin validation:

// Allowed origins whitelist
var allowedOrigins = map[string]bool{
    "https://yourapp.com": true,
    "https://admin.yourapp.com": true,
}

// Custom CORS middleware for Chi
func corsMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        origin := r.Header.Get("Origin")
        if origin == "" || origin == "null" {
            next.ServeHTTP(w, r)
            return
        }
        
        if !allowedOrigins[origin] {
            http.Error(w, "CORS not allowed", http.StatusForbidden)
            return
        }
        
        w.Header().Set("Access-Control-Allow-Origin", origin)
        w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
        w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
        w.Header().Set("Access-Control-Allow-Credentials", "true")
        
        if r.Method == "OPTIONS" {
            w.WriteHeader(http.StatusOK)
            return
        }
        
        next.ServeHTTP(w, r)
    })
}

// Apply to router
r := chi.NewRouter()
r.Use(corsMiddleware)

This implementation validates the Origin header against a whitelist and only sets CORS headers for permitted domains. The AllowCredentials header is now safely used because the origin is explicitly validated.

For Chi applications with multiple services, consider a more sophisticated origin validation:

func validateOrigin(origin string) (string, bool) {
    // Allow exact matches
    if allowedOrigins[origin] {
        return origin, true
    }
    
    // Allow subdomains of allowed domains
    for allowed := range allowedOrigins {
        if strings.HasSuffix(origin, allowed) || strings.HasSuffix(origin, "."+allowed) {
            return allowed, true
        }
    }
    
    return "", false
}

// Enhanced CORS middleware
func corsMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        origin := r.Header.Get("Origin")
        if origin == "" || origin == "null" {
            next.ServeHTTP(w, r)
            return
        }
        
        allowedOrigin, valid := validateOrigin(origin)
        if !valid {
            http.Error(w, "CORS not allowed", http.StatusForbidden)
            return
        }
        
        w.Header().Set("Access-Control-Allow-Origin", allowedOrigin)
        w.Header().Set("Access-Control-Allow-Credentials", "true")
        
        if r.Method == "OPTIONS" {
            w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
            w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
            w.WriteHeader(http.StatusOK)
            return
        }
        
        next.ServeHTTP(w, r)
    })
}

This approach supports wildcard-like behavior for trusted subdomains while maintaining security.

For Chi applications with sensitive endpoints, implement additional protections:

// Router with protected and public routes
func setupRouter() *chi.Mux {
    r := chi.NewRouter()
    
    // Public routes (no CORS restrictions)
    r.Group(func(r chi.Router) {
        r.Use(corsMiddleware)
        r.Get("/public/*", publicHandler)
    })
    
    // Protected routes (additional validation)
    r.Group(func(r chi.Router) {
        r.Use(corsMiddleware)
        r.Use(authMiddleware)
        r.Get("/api/user/{id}", userHandler)
        r.Post("/api/admin/*", adminHandler)
    })
    
    return r
}

// Enhanced user handler with CORS-aware authorization
func userHandler(w http.ResponseWriter, r *http.Request) {
    userID := chi.URLParam(r, "id")
    
    // Check if requester can access this user
    if !canAccessUser(r, userID) {
        http.Error(w, "Access denied", http.StatusForbidden)
        return
    }
    
    user, err := getUser(userID)
    if err != nil {
        http.Error(w, err.Error(), http.StatusNotFound)
        return
    }
    
    json.NewEncoder(w).Encode(user)
}

func canAccessUser(r *http.Request, targetID string) bool {
    // Check authentication
    authUser := r.Context().Value("user")
    if authUser == nil {
        return false
    }
    
    // Check if user is accessing their own data or has admin privileges
    currentUser := authUser.(*User)
    return currentUser.ID == targetID || currentUser.IsAdmin
}

This structure ensures that even with valid CORS requests, users can only access authorized resources.

For comprehensive protection, integrate middleBrick's continuous monitoring to verify that CORS configurations remain secure after deployment:

# Add to CI/CD pipeline
middlebrick scan https://staging.yourservice.com --profile chi --fail-threshold C

The scanner will detect if wildcard origins reappear or if new endpoints inadvertently expose sensitive data through CORS misconfigurations.