Dns Cache Poisoning in Hanami with Api Keys

In Hanami applications that rely on external service discovery via DNS, the interaction between DNS cache poisoning and the use of API keys can lead to severe security outcomes. DNS cache poisoning corrupts the resolver cache with malicious IP mappings, redirecting the application to a rogue server. When API keys are then sent to this poisoned endpoint, the credentials are exposed to an attacker who can replay them or abuse associated permissions.

Consider a Hanami service that resolves api.external.example.com at runtime to retrieve backend microservices. If an attacker can poison the DNS cache for that hostname to point to a malicious server, the Hanami app may unknowingly send authenticated requests containing API keys to the attacker-controlled host. This scenario is particularly impactful when API keys are passed via headers rather than mutual TLS, as there is no cryptographic assurance that the peer is the intended service.

An example flow: a Hanami app loads environment variables containing API keys at boot, then uses a custom HTTP client to call an external API. If DNS resolution occurs after the environment is loaded and the resolver cache is poisoned, the API key is transmitted over a compromised channel to an unauthorized party. This can enable replay attacks, where captured requests and keys are reused against the legitimate service, or credential misuse if the keys have broad scopes.

The risk is compounded when API keys are long-lived or shared across services, as a single poisoned resolution can expose multiple credentials. Attackers may combine DNS cache poisoning with other vectors, such as SSRF, to increase the likelihood of intercepting or manipulating outbound traffic. Because Hanami does not inherently validate the provenance of DNS responses, the framework cannot prevent these cache-based redirections, making it essential to apply network-level mitigations and secure credential handling patterns.

Remediation centers on minimizing exposure of API keys and ensuring that destinations are verified independently of DNS. Prefer short-lived credentials and avoid embedding API keys in environment variables that persist across long-running processes where DNS cache poisoning can take effect.

Use explicit IP addresses or pinned hostnames with certificate pinning where feasible, and validate server identity beyond DNS. Below are concrete Hanami code examples that demonstrate safer handling of API keys.

Example 1: Using short-lived tokens via secure vault integration

module Web
  module Auth
    class TokenProvider
      def self.fetch
        # Retrieve a short-lived token from a vault or secure parameter store
        response = Net::HTTP.get(URI('https://vault.example.com/v1/secret/api-token'))
        json = JSON.parse(response)
        json['data']['token']
      rescue => e
        raise "Token fetch failed: #{e.message}"
      end
    end
  end
end

# In a request service
class ExternalApiClient
  def initialize
    @token = Web::Auth::TokenProvider.fetch
  end

  def call
    uri = URI('https://api.external.example.com/v1/resource')
    req = Net::HTTP::Get.new(uri)
    req['Authorization'] = "Bearer #{@token}"
    req['X-Request-ID'] = SecureRandom.uuid

    http = Net::HTTP.new(uri.hostname, uri.port)
    http.use_ssl = true
    # Pin certificate fingerprint for additional assurance
    http.verify_mode = OpenSSL::SSL::VERIFY_PEER
    http.cert_store = prepare_cert_store

    http.request(req)
  end

  private

  def prepare_cert_store
    store = OpenSSL::X509::Store.new
    store.add_file('path/to/pinned-ca.pem')
    store
  end
end

Example 2: Avoiding persistent API keys in environment variables

module Web
  module Services
    class SecurePaymentGateway
      def post(payload)
        # Fetch API key per-request from a secure parameter manager
        api_key = fetch_api_key
        uri = URI('https://payments.external.example.com/charge')

        http = Net::HTTP.new(uri.hostname, uri.port)
        http.use_ssl = true

        req = Net::HTTP::Post.new(uri)
        req['Authorization'] = "Key #{api_key}"
        req['Content-Type'] = 'application/json'
        req.body = payload.to_json

        http.request(req)
      end

      private

      def fetch_api_key
        # Simulate a secure fetch; in practice integrate with a secrets manager
        ENV['PAYMENT_API_KEY'] # Replace with vault call in production
      end
    end
  end
end

Operational recommendations

• Rotate API keys frequently and bind them to specific IP ranges or VPC endpoints where possible.
• Use mutual TLS for service-to-service communication to reduce reliance on API keys alone.
• Monitor outbound connections for anomalies and implement network-level filtering to limit exposure if DNS cache poisoning occurs.