Crlf Injection in Chi with Api Keys

Crlf Injection occurs when an attacker can inject carriage return (CR, \r) and line feed (\n) characters into HTTP headers or the status line. In the Chi router, this risk arises when user-controlled input is used to construct response headers, the status line, or values stored in headers such as Location or Set-Cookie. When API keys are handled as request parameters, headers, or cookies and then reflected into responses without validation, the combination can allow header manipulation or response splitting.

For example, an API key passed in a query string or header might be logged or echoed into a redirect or a custom header. If Chi routes or handlers directly embed that key or a derived value into a header using string concatenation, an attacker-supplied CR and LF can terminate the intended header line and inject additional headers or a new response body. This can lead to HTTP response splitting, cache poisoning, or the injection of new headers such as Set-Cookie or Location, which may bypass intended access controls or enable further attacks.

Chi applications that expose unauthenticated endpoints or use middleware to inspect or forward API keys are particularly at risk if input validation is limited. Even when API keys are validated, reflection in headers without sanitization creates an opening. The router’s flexible middleware chain means that if a later handler uses a key value in a header, and an earlier stage did not enforce strict constraints, the attack surface expands. This is especially relevant when API keys are used for routing decisions, tenant identification, or rate-limiting contexts where values are passed through multiple handlers.

Because Crlf Injection exploits the HTTP protocol’s line-based format, the impact is not limited to the immediate endpoint. An injected header can affect downstream caches, proxies, or clients that process the response. In API-centric designs where keys are used to drive behavior, ensuring that keys never directly influence header construction—and that any header values are strictly validated or encoded—is essential to prevent split responses and related abuses.

Remediation focuses on preventing CR and LF characters from reaching header construction and ensuring API keys are treated as opaque values. Do not concatenate user input into headers. Instead, use Chi’s built-in mechanisms and validate all inputs rigorously.

Example: Unsafe header construction with an API key

// UNSAFE: directly using a user-provided value in a header
app.get('/redirect', (req, res, next) => {
  string apiKey = req.query["api_key"];
  res.setHeader("X-API-Key", apiKey); // Risk: injection if apiKey contains \r\n
  res.redirect(302, apiKey); // Risk: CRLF injection in Location
  next();
});

Secure remediation: validate and avoid header injection

// SAFE: validate and sanitize before any header use
bool containsCrlf(string value) {
  return value.contains("\r") || value.contains("\n");
}

app.get('/redirect', (req, res, next) => {
  string apiKey = req.query["api_key"];
  if (containsCrlf(apiKey)) {
    res.status(400);
    res.body("Invalid API key");
    return;
  }
  // Use a fixed, safe value or a sanitized key representation
  res.setHeader("X-API-Key-Hash", sha256(apiKey)); // Store a hash, not the raw key
  res.redirect(302, "/dashboard"); // Use a hardcoded or derived safe URL
  next();
});

// Middleware approach: enforce header safety across routes
app.use((req, res, next) => {
  // Inspect headers for CRLF as an additional safeguard
  foreach (string headerValue in req.headers.Values()) {
    if (containsCrlf(headerValue)) {
      res.status(400);
      res.body("Invalid header value");
      return;
    }
  }
  next();
});

Middleware validation and safe key handling

Use Chi’s middleware to validate inputs early and reject requests containing control characters. Treat API keys as opaque strings; avoid echoing them in headers or status locations. Prefer hashing keys for logging or setting non-injectable identifiers.

// Central validation middleware
app.use((req, res, next) => {
  string? apiKey = req.query["api_key"] ?? req.headers["api-key"];
  if (!string.IsNullOrEmpty(apiKey) && containsCrlf(apiKey)) {
    res.status(400);
    res.body("Invalid API key");
    return;
  }
  next();
});

// Safe header setting: never use raw user input
app.get('/data', (req, res, next) => {
  // Use a server-side identifier instead of exposing the key
  string requestId = Guid.NewGuid().ToString();
  res.setHeader("X-Request-ID", requestId);
  // Process request using server-side key management
  next();
});

Additional measures

• Always validate and sanitize inputs before using them in headers, status lines, or redirects.
• Use framework features for redirects and header setting rather than manual string assembly.
• Log hashed or truncated representations of keys instead of raw values.
• Employ Chi middleware to enforce header safety across all routes.