Cryptographic Failures in Fiber with Firestore

Cryptographic Failures occur when sensitive data is transmitted or stored without adequate protection, or when cryptographic controls are misapplied. The combination of the Fiber web framework and Google Cloud Firestore can inadvertently expose such failures through common patterns: transmitting data over insecure channels, storing sensitive fields without encryption-at-rest control (relying solely on server-side encryption without envelope encryption or client-side safeguards), and mishandling cryptographic keys or secrets in configuration. In a typical Fiber app that reads or writes Firestore documents, developers might pass sensitive payloads—such as authentication tokens, personally identifiable information (PII), or cryptographic keys—through unsecured HTTP endpoints, or log Firestore query snapshots containing raw data. Because Firestore encrypts data at rest automatically, developers may assume compliance is automatic; however, runtime exposure often stems from Fiber route handlers that do not enforce transport security, validate input, or apply field-level encryption before persistence. For example, a POST /users endpoint that directly writes req.body to a Firestore collection without sanitization can leak credentials or PII if the request is not protected by HTTPS or if the client mistakenly sends secrets over HTTP. Similarly, deserializing Firestore documents into loosely typed structs without integrity checks can lead to injection of maliciously altered data, facilitating tampering or privilege escalation. These issues map to OWASP API Security Top 10 categories such as Broken Object Level Authorization (BOLA) and Data Exposure, and can be surfaced by middleBrick’s Data Exposure and Input Validation checks. Real-world attack patterns include session hijacking via intercepted tokens or exfiltration of Firestore document contents through error messages or logs, emphasizing the need for strict transport security, input validation, and cryptographic hygiene in Fiber-Firestore integrations.

To mitigate Cryptographic Failures when using Fiber with Firestore, enforce HTTPS, validate and sanitize all inputs, and apply field-level encryption for highly sensitive attributes before writing to Firestore. The following examples demonstrate secure patterns using the Firestore Go SDK with Fiber.

Enforce HTTPS and secure transport

Ensure your Fiber app only accepts requests over TLS. In production, terminate TLS at the load balancer or reverse proxy, but also configure Fiber to reject non-TLS routes where applicable.

// main.go
package main

import (
	"log"
	"net/http"

	"github.com/gofiber/fiber/v2"
)

func main() {
	app := fiber.New()
	// Enforce secure transport at the app level as a defense-in-depth measure
	app.Use(func(c *fiber.Ctx) error {
		if c.Protocol() != "https" {
			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "HTTPS required"})
		}
		return c.Next()
	})
	log.Fatal(app.ListenTLS(":443", "cert.pem", "key.pem"))
}

Validate and sanitize input before Firestore write

Use strict validation on incoming JSON and avoid directly mapping untrusted request bodies to Firestore documents. Apply allowlists for fields and encode or remove sensitive keys.

// handlers.go
package handlers

import (
	"context"
	"fmt"
	"net/http"

	"cloud.google.com/go/firestore"
	"github.com/gofiber/fiber/v2"
	"google.golang.org/api/iterator"
)

type CreateUserRequest struct {
	Email string `json:"email" validate:"required,email"`
	Name  string `json:"name" validate:"required,min=2,max=100"`
	// Never include raw password in the same document; use a separate secure store or auth system
	Password string `json:"-"` // ignore during binding
}

func (r *CreateUserRequest) ToFirestore(doc map[string]interface{}) map[string]interface{} {
	// Explicitly control which fields are written to Firestore
	return map[string]interface{}{
		"email": r.Email,
		"name":  r.Name,
		// Do not write Password, SecretKey, or PII without encryption
	}
}

func NewUserHandler(client *firestore.Client) fiber.Handler {
	return func(c *fiber.Ctx) error {
		var req CreateUserRequest
		if err := c.BodyParser(&req); err != nil {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid payload"})
		}
		// Use a validation library to check required constraints
		if req.Email == "" || req.Name == "" {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "missing required fields"})
		}

		ctx := context.Background()
		doc := req.ToFirestore(nil)
		// Write with explicit field control instead of raw struct marshaling
		_, err := client.Collection("users").Add(ctx, doc)
		if err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to create user"})
		}
		return c.Status(fiber.StatusCreated).JSON(fiber.Map{"status": "created"})
	}
}

Encrypt sensitive fields before storing

For fields such as API keys or PII, use envelope encryption or a deterministic encryption scheme before persisting. Never rely on Firestore server-side encryption alone for confidentiality at the application layer.

// encryption.go
package main

import (
	"context"
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"io"
)

// encryptField encrypts a plaintext string with AES-GCM using a key managed outside Firestore.
func encryptField(plaintext string, key []byte) (string, error) {
	block, err := aes.NewCipher(key) // key must be 32 bytes for AES-256
	if err != nil {
		return "", err
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return "", err
	}
	nonce := make([]byte, gcm.NonceSize())
	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
		return "", err
	}
	ciphertext := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
	return base64.StdEncoding.EncodeToString(ciphertext), nil
}

// Example usage within a Fiber handler
func SaveSensitiveDataHandler(client *firestore.Client) fiber.Handler {
	return func(c *fiber.Ctx) error {
		// In practice, derive or retrieve your key from a secure secret manager
		key := []byte("example-32-byte-long-key-1234567890ab") // placeholder only
		payload := c.FormValue("data")
		encrypted, err := encryptField(payload, key)
		if err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "encryption failed"})
		}
		ctx := context.Background()
		_, err = client.Collection("secrets").Add(ctx, map[string]interface{}{
			"encrypted_data": encrypted,
			"created_at":     firestore.ServerTimestamp,
		})
		if err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "write failed"})
		}
		return c.JSON(fiber.Map{"status": "stored"})
	}
}

Secure Firestore document reads

When reading documents, avoid exposing raw sensitive fields to the client. Filter or transform data at the handler level and enforce strict access controls.

// handlers.go continued
func GetUserHandler(client *firestore.Client) fiber.Handler {
	return func(c *fiber.Ctx) error {
		id := c.Params("id")
		ctx := context.Background()
		doc, err := client.Collection("users").Doc(id).Get(ctx)
		if err != nil {
			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "not found"})
		}
		// Explicitly omit sensitive fields
		data := doc.Data()
		safe := map[string]interface{}{
			"email": data["email"],
			"name":  data["name"],
			// Do not include "password_hash", "api_key", etc.
		}
		return c.JSON(safe)
	}
}

By combining HTTPS enforcement, strict input validation, and selective field handling, you reduce the attack surface for Cryptographic Failures in a Fiber-Firestore stack. middleBrick scans can help detect exposed sensitive data and missing transport protections during development, guiding focused remediation.