Dangling Dns in Gin with Basic Auth

A dangling DNS record occurs when a hostname remains in DNS but no corresponding service is deployed. In Go Gin applications that rely on Basic Auth, this combination can expose internal or staging endpoints and authentication bypass risks. When a Gin route uses a hostname defined in DNS for routing or configuration, and that hostname resolves to a missing or unintended service, requests may be handled unexpectedly.

Consider a Gin service that performs Basic Auth validation before forwarding requests to an upstream service using a hostname stored in configuration or derived from request headers. If the upstream hostname is a dangling DNS entry, the Gin application might route traffic to an unintended host that does not enforce proper authentication. Attackers can probe for such misconfigurations by supplying crafted Host headers or environment-specific values that cause Gin to resolve the dangling record.

During a middleBrick scan, the unauthenticated checks test how Gin endpoints handle malformed or unexpected Host headers and DNS resolution paths. The scanner verifies whether Basic Auth credentials are validated before any network call and whether hostname resolution is tightly scoped. Without strict hostname verification, an application may inadvertently trust a dangling DNS entry, leading to information exposure or unauthorized access to an otherwise unreachable service.

For example, if a Gin handler uses a hardcoded upstream URL with a dangling hostname and applies Basic Auth only on the outer endpoint, an attacker who can control DNS or observe internal naming conventions might identify endpoints that skip authorization due to resolution failure. MiddleBrick’s checks for BOLA/IDOR and Unsafe Consumption highlight whether authorization is consistently enforced, even when DNS or network conditions change.

Using the OpenAPI/Swagger spec analysis feature of middleBrick, teams can cross-reference declared hosts and paths with runtime behavior. The scanner resolves $ref definitions and checks whether the Gin service’s declared security schemes align with actual enforcement, particularly when dynamic hostnames are involved. This helps identify mismatches where Basic Auth is documented but not consistently applied across all routing scenarios.

Remediation focuses on ensuring Basic Auth credentials are validated before any network or DNS-dependent operations and by avoiding reliance on potentially dangling hostnames. Always parse and verify credentials synchronously within the Gin handler chain, and do not forward requests to upstream services without re-authorizing or re-validating.

Use a strict allowlist of hostnames or IPs for upstream calls, and avoid constructing URLs from user-controlled input. Implement explicit checks for the presence and correctness of Authorization headers before proceeding.

The following example shows a secure Gin handler with Basic Auth validation and no dependency on external hostname resolution for access control:

package main

import (
    "net/http"
    "strings"

    "github.com/gin-gonic/gin"
    "github.com/dgrijalva/jwt-go"
)

// BasicAuthMiddleware validates Authorization header before routing
func BasicAuthMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        auth := c.GetHeader("Authorization")
        if auth == "" {
            c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "authorization header required"})
            return
        }

        const prefix = "Basic "
        if !strings.HasPrefix(auth, prefix) {
            c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid authorization type"})
            return
        }

        payload, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
        if err != nil {
            c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid authorization encoding"})
            return
        }

        // Expected format: username:password
        parts := strings.SplitN(string(payload), ":", 2)
        if len(parts) != 2 || parts[0] != "admin" || parts[1] != "s3cr3t" {
            c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
            return
        }

        c.Next()
    }
}

// Safe handler that does not forward to dangling DNS entries
func GetData(c *git.Context) {
    // Authorization already verified by middleware
    c.JSON(http.StatusOK, gin.H{"message": "secure data"})
}

func main() {
    r := gin.Default()
    r.Use(BasicAuthMiddleware())
    r.GET("/data", GetData)
    r.Run()
}

In this example, the handler does not construct outgoing requests using dynamic hostnames that could be dangling. If upstream calls are required, perform hostname validation against an allowlist and ensure credentials are rechecked or transformed for the downstream request.

middleBrick’s CLI can be used to verify that your endpoints enforce authentication correctly: middlebrick scan <url>. The GitHub Action helps enforce these rules in CI/CD, failing builds if security scores drop below your chosen threshold.