Dns Cache Poisoning in Chi with Basic Auth

Chi is a lightweight HTTP client for .NET commonly used to call HTTP APIs. When Chi sends requests with HTTP Basic Authentication, it typically adds an Authorization header derived from a username and password. Dns Cache Poisoning can intersect with this pattern when an attacker manipulates DNS responses so that a hostname (for example, api.example.com) resolves to a malicious IP. If Chi does not validate the server’s identity beyond the initial DNS lookup, the poisoned DNS entry can redirect credentials to an attacker.

Because Chi does not inherently enforce certificate hostname verification when you configure it to use a custom HttpClientHandler or bypass standard TLS checks, a poisoned DNS record can cause authentication traffic to be sent to an endpoint controlled by an attacker. In this scenario, Basic Auth credentials (base64-encoded in the header) are still sent, but to the wrong host. An attacker capturing those credentials can reuse them to impersonate the client against the legitimate service, especially if the transport is not further validated.

The combination is risky when developers use Chi with hardcoded credentials or tokens in code and rely solely on DNS resolution without additional safeguards. If the API endpoint URL is supplied via configuration or environment variables and an attacker compromises DNS (via cache poisoning or a malicious resolver), the Basic Auth header travels to an unintended host. This does not mean Chi is broken; it means that without hostname pinning, certificate validation, or strict control of name resolution, Basic Auth over a potentially poisoned DNS path exposes credentials and session tokens.

To detect such issues, you can scan your API endpoints with middleBrick. middleBrick runs 12 security checks in parallel, including Authentication and Input Validation, and can surface misconfigurations in how endpoints are resolved and authenticated. Its LLM/AI Security checks also probe for unsafe exposure of credentials in prompts or logs that could compound risks when DNS is unreliable.

Remediation focuses on ensuring that Chi validates the server identity and uses secure transport even when DNS is unreliable. Prefer using HTTPS with certificate validation, avoid embedding credentials in code, and do not disable certificate checks. Below are concrete, safe patterns for using Basic Auth with Chi.

1. Use HttpClient with default handler and enforce HTTPS

Let the runtime handle DNS and TLS. Do not use a custom handler that disables certificate validation.

using System.Net.Http;
using System.Net.Http.Headers;
using System.Threading.Tasks;

public class ApiClient
{
    private readonly HttpClient _http;

    public ApiClient()
    {
        _http = new HttpClient();
        _http.BaseAddress = new System.Uri("https://api.example.com/");
        _http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", "dXNlcm5hbWU6cGFzc3dvcmQ="); // "username:password" base64 encoded
    }

    public async Task GetDataAsync()
    {
        var response = await _http.GetAsync("resource");
        response.EnsureSuccessStatusCode();
        return await response.Content.ReadAsStringAsync();
    }
}

2. Avoid disabling certificate validation

Never use ServerCertificateCustomValidationCallback in production unless you fully understand the security impact. The following pattern shows what to avoid:

// UNSAFE: disables TLS validation — do not use
var handler = new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true
};
var unsafeClient = new HttpClient(handler);
// Do not use this with Basic Auth over untrusted networks

3. Rotate credentials and scope permissions

Minimize the impact of credential exposure by using short-lived tokens or rotating secrets. If you must use Basic Auth, ensure the credentials have minimal privileges and are rotated regularly.

4. Use environment variables or secure configuration

Do not hardcode credentials. Load them securely at runtime.

var username = Environment.GetEnvironmentVariable("API_USER");
var password = Environment.GetEnvironmentVariable("API_PASS");
var creds = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes($"{username}:{password}"));
_http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", creds);

5. Consider alternatives to Basic Auth

For new integrations, prefer token-based authentication (e.g., OAuth 2.0 bearer tokens) which can be short-lived and scoped. If you must keep Basic Auth, enforce HTTPS and validate server certificates explicitly.

middleBrick can be used in your CI/CD pipeline with the GitHub Action to ensure that authentication configurations are not introducing weaknesses. Its Pro plan provides continuous monitoring so changes in authentication behavior are flagged early.