Dangling Dns in Chi with Api Keys

A dangling DNS record in a Chi configuration, combined with the use of API keys for authorization, can expose an API to unintended access and data exposure. In Chi, route definitions often include host or domain constraints that rely on DNS resolution. If a route is configured with a pattern such as /api/* under a domain that later changes or is removed from DNS management, the route may remain reachable through a stale or unresolved hostname. When API keys are used as the primary credential, the system may still accept requests directed at the orphaned DNS entry, bypassing intended network or tenant isolation.

In this scenario, the API key is treated as a valid token regardless of the request’s target hostname. If the DNS record is not properly revoked or reconfigured, an attacker who discovers the dangling hostname may send requests with a valid API key to an environment that should be isolated, such as a staging or deprecated service. This violates the principle of secure default networking boundaries and can lead to unauthorized access to sensitive endpoints, especially if the underlying service does not revalidate the intended destination against the request’s Host header.

The vulnerability is amplified when OpenAPI specifications are used without runtime hostname validation. A specification may define a server entry like https://api-staging.example.com, but if DNS for api-staging.example.com is not maintained, the service may still respond on that hostname if a load balancer or proxy routes traffic elsewhere. middleBrick’s OpenAPI/Swagger analysis resolves $ref definitions and cross-references spec declarations with runtime behavior, which helps detect mismatches between documented hosts and actual resolvable endpoints during a scan.

Because middleBrick scans the unauthenticated attack surface first, it can identify whether a dangling DNS hostname returns any response at all. If the endpoint echoes back API key requirements or reveals version details, it may indicate that authentication is enforced at the application layer but network segregation is weak. This misalignment between DNS hygiene and token-based access control is a common root cause of misconfigured public exposure, and it is one of the scenarios covered in the BFLA/Privilege Escalation and Property Authorization checks.

During a scan, middleBrick tests multiple security checks in parallel, including Data Exposure and Inventory Management, to determine whether sensitive information is returned from endpoints associated with unresolved hosts. If an API key is accepted on a dangling route, the finding will include severity, guidance on DNS cleanup, and a note to align route definitions with active DNS records. The tool does not block or fix the configuration, but it provides actionable remediation steps to reduce the attack surface.

To remediate risks related to dangling DNS records when using API keys in Chi, focus on tightening host validation and ensuring that routes are only served for intended domains. Below are concrete examples showing how to define strict hostname matching and reject requests with unexpected Host headers.

Chi route definition with host restriction

// Chi routes restricted to a specific hostname
package main

import (
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

func main() {
	r := chi.NewRouter()
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)

	// Only accept requests for the intended domain
	hostSni := "api.example.com"
	r.With(middleware.Host(hostSni)).Get("/api/health", func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
		w.Write([]byte(`{"status":"ok"}`))
	})

	// Optional: fallback handler for mismatched hosts
	r.With(middleware.Host(`{any:.+}`)).Get("/api/*", func(w http.ResponseWriter, r *http.Request) {
		http.Error(w, "host not allowed", http.StatusForbidden)
	})

	http.ListenAndServe(":8080", r)
}

Validating API key usage only for correct hostname

// Middleware to enforce hostname and API key checks
func apiKeyAndHostMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		expectedHost := "api.example.com"
		if r.Host != expectedHost {
			http.Error(w, "invalid host header", http.StatusForbidden)
			return
		}

		apiKey := r.Header.Get("X-API-Key")
		if apiKey == "" || apiKey != "your-secure-key-here" {
			http.Error(w, "unauthorized", http.StatusUnauthorized)
			return
		}

		next.ServeHTTP(w, r)
	})
}

// Applying the middleware to protected routes
r := chi.NewRouter()
r.Use(apiKeyAndHostMiddleware)
r.Get("/api/data", func(w http.ResponseWriter, r *http.Request) {
	w.Write([]byte(`{"data":"protected"}`))
})

These examples ensure that even if a DNS record points to the service, requests with mismatched Host headers are rejected before authentication is evaluated. This reduces the risk of accidental exposure through misconfigured or stale DNS entries.

middleBrick’s CLI tool can be used to verify that no responses are returned from unintended hosts. By running middlebrick scan <url>, you can confirm that the API does not leak information on incorrect hostnames and that API key enforcement is consistently applied across expected endpoints.