Credential Stuffing in Fiber with Hmac Signatures

Credential stuffing is an automated attack where attackers use lists of breached username and password pairs to gain unauthorized access. In a Fiber-based application that uses Hmac Signatures for request authentication, a common pattern is to sign a canonical string (e.g., method + path + timestamp + body) with a shared secret to produce an Hmac header. If the server validates the signature but does not enforce strict per-request protections, credential stuffing can be combined with signature replay to probe authentication endpoints.

Consider a login route that accepts POST /login with a JSON body containing username and password, and requires an X-Signature header containing the Hmac SHA256 of the request payload using a shared secret. An attacker can harvest username/password pairs from credential stuffing campaigns and, for each pair, craft a properly signed request. Because the signature is computed over the request body, if the server does not include a nonce or a per-request timestamp bound to the signature validation, the same signed payload can be replayed. This means attackers can automate login attempts at scale while each request carries a valid Hmac Signature, bypassing naive IP-based or rate-limiting defenses that only inspect request volume without validating intent.

Additionally, if the application does not enforce strong binding between the authenticated user context and the signature (for example, including the username or user ID inside the signed string and verifying it matches the payload), attackers might try different usernames within the same signature framework to identify valid accounts. The risk is compounded when the login endpoint does not enforce adequate rate limiting or when error messages differ between invalid credentials and invalid signatures, allowing attackers to infer whether a username exists. Because Hmac Signatures ensure integrity and authenticity of the request, attackers who obtain a valid signature for one request can sometimes reuse it in related endpoints if the server does not check scope and replay constraints.

From an API security scanning perspective, middleBrick evaluates whether endpoints that use Hmac Signatures are susceptible to credential stuffing by checking for missing replay protection, weak rate limiting, and inconsistent error handling. The scan runs 12 security checks in parallel, including Authentication, Input Validation, Rate Limiting, and Unsafe Consumption, to surface risky patterns such as unsigned or weakly bound Hmac usage and to provide prioritized findings with severity and remediation guidance.

To mitigate credential stuffing when using Hmac Signatures in Fiber, you should bind the signature to a per-request nonce and timestamp, enforce strict replay windows, and ensure constant-time comparison. Below are concrete, syntactically correct examples in Go using the net/http package and the Fiber framework.

1. Signed request with nonce and timestamp

Client computes the signature over method, path, timestamp, nonce, and body. The server recomputes and compares using crypto/subtle.

// client-side: build and sign request
package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"net/http"
	"strings"
	"time"
)

const sharedSecret = "super-secret-shared-key"

func sign(method, path string, ts int64, nonce, body string) string {
	mac := hmac.New(sha256.New, []byte(sharedSecret))
	mac.Write([]byte(method + path + string(rune(ts)) + nonce + body))
	return hex.EncodeToString(mac.Sum(nil))
}

func makeRequest(client *http.Client, url, method, body string) (*http.Request, error) {
	ts := time.Now().UnixNano() / int64(time.Millisecond)
	nonce := "unique-nonce-abc123" // in practice use a strong random value per request
	req, err := http.NewRequest(method, url, strings.NewReader(body))
	if err != nil {
		return nil, err
	}
	signature := sign(method, url, ts, nonce, body)
	req.Header.Set("X-Timestamp", string(rune(ts)))
	req.Header.Set("X-Nonce", nonce)
	req.Header.Set("X-Signature", signature)
	return req, nil
}

2. Server-side verification in Fiber

Server validates timestamp freshness, nonce uniqueness (e.g., short cache), constant-time signature comparison, and ensures the username is part of the signed data to prevent tampering.

// server-side: Fiber handler
package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"net/http"
	"strings"
	"time"

	"github.com/gofiber/fiber/v2"
)

const sharedSecret = "super-secret-shared-key"
var seenNonces = make(map[string]bool) // in production use a bounded cache with TTL

func verifyHmac(c *fiber.Ctx) error {
	body := c.Request().Body() // read body carefully; in practice use a limited reader or caching
	method := c.Method()
	path := c.Path()
	tsHeader := c.Get("X-Timestamp")
	nonce := c.Get("X-Nonce")
	sigHeader := c.Get("X-Signature")

	if tsHeader == "" || nonce == "" || sigHeader == "" {
		return c.Status(http.StatusBadRequest).JSON(fiber.Map{"error": "missing headers"})
	}

	// Prevent replay: enforce a small window and unique nonces
	var ts int64
	// parse ts safely; omitted for brevity
	if time.Since(time.Unix(0, ts*int64(time.Millisecond))) > 30*time.Second {
		return c.Status(http.StatusRequestTimeout).JSON(fiber.Map{"error": "timestamp expired"})
	}
	if seenNonces[nonce] {
		return c.Status(http.StatusForbidden).JSON(fiber.Map{"error": "replay detected"})
	}
	seenNonces[nonce] = true

	// Recompute signature with the same canonical string the client used
	mac := hmac.New(sha256.New, []byte(sharedSecret))
	mac.Write([]byte(method + path + tsHeader + nonce + string(body)))
	expected := hex.EncodeToString(mac.Sum(nil))

	if !hmac.Equal([]byte(expected), []byte(sigHeader)) {
		return c.Status(http.StatusUnauthorized).JSON(fiber.Map{"error": "invalid signature"})
	}

	// At this point, the request is authenticated; proceed with login logic
	// Ensure username is part of signed data or verified server-side to prevent account enumeration issues
	return c.SendString("ok")
}

Key remediation steps reflected in the scans include: enforcing per-request nonces and short timestamp windows to prevent replay, using a constant-time comparison (hmac.Equal), including user-bound data in the signed string to avoid tampering, and ensuring uniform error responses to avoid account enumeration. middleBrick’s checks for Authentication, Rate Limiting, and Unsafe Consumption will highlight whether these protections are missing or inconsistent.