Dangling Dns in Koa with Api Keys

A dangling DNS configuration in a Koa application that relies on API keys can expose internal or unresolved endpoints during client redirection or webhook resolution. When an API key is accepted as a bearer token or query parameter and passed to an outbound HTTP request, the server may use a hostname that is not fully qualified or is dynamically constructed. If the DNS record for that hostname becomes stale, is removed, or fails to resolve at request time, the request may resolve to an unintended IP address, including an attacker-controlled host.

In this scenario, the API key remains valid and is transmitted to the dangling host, which can lead to authentication tokens being sent to an external party or to an internal service that is no longer properly isolated. Because middleBrick scans unauthenticated attack surfaces, it can detect that outbound calls from Koa endpoints lack strict hostname validation or certificate pinning, and that API keys are used in contexts where DNS resolution is not enforced or verified. The scan flags cases where responses from unresolved or mismatched hosts are accepted without confirming the authenticity of the target, effectively turning the API key into a credential delivered to an unknown endpoint.

The LLM/AI security checks in middleBrick further highlight risks when API keys are logged or echoed in error responses triggered by failed DNS resolution, as this can leak secrets through verbose stack traces or application telemetry. Combined with input validation checks, middleBrick identifies that user-controlled host segments or open redirect parameters can manipulate the final resolved address, especially when API keys are appended to dynamically built URLs without strict allowlists or schema enforcement.

To mitigate dangling DNS risks while using API keys in Koa, enforce strict hostname resolution, validate targets before making outbound calls, and avoid constructing URLs from uncontrolled input. Use a static allowlist of endpoints for each API key, and ensure TLS verification is enabled. Prefer environment variables or a secrets manager for key storage, and reject requests that reference dynamic or user-supplied host components.

Secure outbound call with fixed endpoint

const Koa = require('koa');
const axios = require('axios');

const app = new Koa();
const ALLOWED_TARGETS = new Set([
  'api.example.com',
  'internal.example.com'
]);

app.use(async (ctx, next) => {
  const requestedHost = ctx.request.query.host;
  const apiKey = process.env.EXTERNAL_API_KEY;

  // Reject if host is not explicitly allowed
  if (!requestedHost || !ALLOWED_TARGETS.has(requestedHost)) {
    ctx.status = 400;
    ctx.body = { error: 'invalid_target' };
    return;
  }

  try {
    const url = `https://${requestedHost}/v1/resource`;
    const response = await axios.get(url, {
      headers: {
        Authorization: `Bearer ${apiKey}`,
        'Accept': 'application/json'
      },
      httpsAgent: new (require('https').Agent)({ rejectUnauthorized: true }),
      timeout: 5000
    });
    ctx.body = response.data;
  } catch (err) {
    ctx.status = 502;
    ctx.body = { error: 'upstream_error' };
  }
  await next();
});

app.listen(3000);

Environment-based API key with strict TLS and host validation

const Koa = require('koa');
const fetch = require('node-fetch');

const app = new Koa();
const API_KEY = process.env.EXTERNAL_API_KEY;
const TRUSTED_HOST = 'api.example.com';

app.use(async (ctx) => {
  if (!API_KEY) {
    ctx.status = 500;
    ctx.body = { error: 'missing_key' };
    return;
  }

  const target = TRUSTED_HOST;
  const url = `https://${target}/v2/data`;

  const res = await fetch(url, {
    method: 'GET',
    headers: {
      Authorization: `ApiKey ${API_KEY}`,
      'Host': target
    },
    redirect: 'manual'
  });

  if (res.status >= 200 && res.status < 300) {
    const data = await res.json();
    ctx.body = data;
  } else {
    ctx.status = 502;
    ctx.body = { error: 'fetch_failed' };
  }
});

app.listen(3000);

Key practices to prevent dangling DNS with API keys

• Do not concatenate user input into hostnames used for outbound requests.
• Pin certificates and reject unauthorized hosts even if DNS resolves.
• Rotate API keys if there is any suspicion that credentials were sent to an unintended host.
• Use middleBrick’s dashboard to track scans over time and detect patterns where endpoints resolve inconsistently.
• For CI/CD, integrate the GitHub Action to fail builds when outbound calls lack host allowlists or when API keys appear in error messages.