Dangling Dns in Chi with Jwt Tokens

A dangling DNS configuration in a Chi application becomes high-risk when JWT tokens are used for authentication. Chi is a functional web framework for Clojure, and it typically relies on middleware to validate incoming requests. When JWT tokens are accepted but the runtime cannot reliably resolve or validate the origin of DNS-dependent services, an attacker may exploit resolution ambiguities to redirect token validation logic.

During a middleBrick scan, the tool checks unauthenticated surfaces and flags issues such as BOLA/IDOR alongside DNS-related exposures. If a Chi service accepts a JWT and then performs DNS-based lookups—such as validating issuer endpoints, fetching JWKS from a hostname, or confirming resource ownership via DNS records—an attacker can register a domain that points to a malicious server. Because the JWT validation flow trusts DNS resolution outcomes, the token may be accepted based on a poisoned DNS response.

This can occur when configuration points to a hostname instead of a fixed IP or pinned endpoint, and the application does not enforce strict DNS hygiene or certificate binding. For example, if the JWT issuer validation logic resolves a hostname dynamically and an attacker controls the DNS record at that moment, they could present a valid certificate for a different domain that passes hostname checks but is not trusted. MiddleBrick’s checks for Data Exposure and Input Validation highlight these weak points by correlating spec definitions with runtime behavior, identifying cases where DNS resolution is part of the authentication path.

Additionally, SSRF and unsafe consumption checks may surface when internal Chi services use JWTs and rely on external DNS endpoints for logging, metrics, or introspection. An attacker who can influence a hostname through a configuration or header may force the application to leak tokens or internal network details via DNS queries. The scanner flags these patterns, noting how token validation and network resolution intersect to create an expanded attack surface.

Using the CLI tool, you can verify how often your Chi service resolves external hosts during token validation by inspecting logs and network traces. The dashboard helps track these findings over time, while the GitHub Action can prevent merges if risk scores degrade due to newly introduced DNS-dependent JWT validation steps.

To reduce risk, harden JWT validation in Chi by removing dynamic DNS dependencies for critical checks and using explicit, trusted endpoints. Prefer static IPs or pinned hostnames for JWKS and issuer validation, and avoid relying on runtime DNS resolution for security decisions.

Example 1: Static JWKS endpoint with HTTP client

(ns myapp.auth
  (:require [clj-http.client :as http]
            [cheshire.core :as json]
            [buddy.jwt :as jwt]))

(def ^:private jwks-url "https://login.example.com/.well-known/jwks.json")

(defn fetch-jwks []
  (let [response (http/get jwks-url {:timeout 5000})]
    (when (= 200 (:status response))
      (json/parse-string (:body response) true))))

(defn validate-token [token]
  (let [jwks (or (fetch-jwks) (throw (ex-info "JWKS unavailable" {})))]
    (jwt/verify token {:jwks jwks})))

Example 2: Enforcing issuer and audience without DNS-dependent lookups

(ns myapp.auth
  (:require [buddy.jwt :as jwt]
            [buddy.sign.jwt :as jwt-sign]))

(def expected-issuer "https://login.example.com/")
(def expected-audience "my-chi-app")

(defn validate-claims [token]
  (let [decoded (jwt/unsign token :your-hmac-key)]
    (when-not (= (:iss decoded) expected-issuer)
      (throw (ex-info "Invalid issuer" {:status 401})))
    (when-not (= (:aud decoded) expected-audience)
      (throw (ex-info "Invalid audience" {:status 401})))
    decoded))

Example 3: Using an MCP-integrated workflow for continuous validation

With the MCP Server, you can scan APIs directly from your AI coding assistant. If a Chi project includes JWT validation, the assistant can surface insecure patterns during development. Combine this with the CLI to run scans locally:

$ middlebrick scan https://api.example.com

Configure the GitHub Action to fail builds when the score drops below your threshold, ensuring DNS-sensitive JWT validation is reviewed before deployment.

General remediation steps

• Replace dynamic DNS-based issuer resolution with pinned endpoints.
• Validate JWT claims strictly (iss, aud, exp) using static values.
• Restrict outbound DNS queries for authentication paths via network policies.
• Monitor findings in the dashboard and set alerts via Pro plan Slack/Teams notifications.