Dns Rebinding in Buffalo with Jwt Tokens

DNS rebinding is a client-side network attack that manipulates DNS responses to make a victim’s browser connect to an internal IP address that differs from the originally resolved hostname. In a Buffalo application that relies on JWT tokens for authentication, this combination can undermine trust boundaries the developer assumes are enforced by the token itself.

Consider a Buffalo app that uses JWTs for sessionless authentication, where the client stores the token (for example in localStorage or an httpOnly cookie) and sends it in an Authorization header on every request. If the app’s frontend is served from a hostname like app.example.com and the backend API is at api.example.com, both resolving to a public IP, an attacker can craft a page that causes the browser to later send requests to an internal address such as 127.0.0.1 or 192.168.x.x while still including the JWT originally obtained for app.example.com.

Because the JWT is often validated only on the server side without additional context checks, the server may accept the token and process the request as if it originated from the expected public origin. This becomes particularly dangerous when the endpoint performs privileged actions (e.g., changing admin settings or reading internal services) and lacks strict origin or referer validation. A typical chain is: a user visits a malicious site, DNS rebinding causes the browser to pivot to an internal endpoint, and the request carries a valid JWT that the server trusts.

Buffalo’s middleware stack does not inherently protect against this pivot unless you explicitly enforce same-origin policies or validate the Host header and source IP. Because the framework encourages quick iteration and convention over configuration, developers might overlook binding the token’s scope to the expected network path. The result is an authorization bypass that appears to be authenticated (valid JWT) but is actually connecting to an unintended internal target. This maps to OWASP API Top 10’s Broken Object Level Authorization (BOLA) and can be observed in scans run by middleBrick, which tests unauthenticated attack surfaces and flags missing network-level controls alongside JWT validation issues.

To detect such misconfigurations, scans should include scenarios where the request origin is manipulated while a valid JWT is presented. middleBrick’s inventory and input validation checks can surface endpoints that do not verify host or origin in conjunction with token validity, providing a prioritized finding with severity and remediation guidance.

Remediation centers on ensuring that JWT validation is coupled with origin and host checks, and that tokens are not accepted indiscriminately across different network endpoints. Below are concrete, working examples in Go using the Buffalo framework.

JWT Validation with Host and Origin Verification

Use a middleware that validates the JWT and also confirms that the request’s Host and Origin align with your expected domain. This reduces the window for DNS rebinding even when a token is present.

package middleware

import (
    "net/http"
    "strings"

    "github.com/gobuffalo/buffalo"
    "github.com/gobuffalo/buffalo/middleware"
    "github.com/golang-jwt/jwt/v5"
)

func JWTWithHostCheck(secret string, allowedHost string) buffalo.HandlerFunc {
    return func(c *buffalo.Context) error {
        auth := c.Request.Header.Get("Authorization")
        if auth == "" {
            return c.Error(http.StatusUnauthorized, errors.New("authorization header required"))
        }
        const bearerPrefix = "Bearer "
        if !strings.HasPrefix(auth, bearerPrefix) {
            return c.Error(http.StatusUnauthorized, errors.New("invalid authorization format"))
        }
        tokenString := auth[len(bearerPrefix):]
        token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
            if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
                return nil, http.ErrAbortHandler
            }
            return []byte(secret), nil
        })
        if err != nil || !token.Valid {
            return c.Error(http.StatusUnauthorized, errors.New("invalid token"))
        }
        // Host and Origin checks to mitigate rebinding
        if c.Request.Host != allowedHost {
            return c.Error(http.StatusForbidden, errors.New("host not allowed"))
        }
        origin := c.Request.Header.Get("Origin")
        if origin == "" || !strings.HasPrefix(origin, "https://"+allowedHost) {
            return c.Error(http.StatusForbidden, errors.New("origin not allowed"))
        }
        c.Set("claims", token.Claims)
        return c.Next()
    }
}

Secure Endpoint Example

Apply the middleware to routes that require both authentication and network context. This ensures that even if a JWT is valid, requests from unexpected hosts are rejected.

package actions

import (
    "net/http"

    "github.com/gobuffalo/buffalo"
    "github.com/gobuffalo/buffalo/middleware"
    "yourapp/middleware"
)

func Home() buffalo.Action {
    return func(c *buffalo.Context) error {
        claims, ok := c.Get("claims").(jwt.MapClaims)
        if !ok {
            return c.Error(http.StatusUnauthorized, errors.New("claims missing"))
        }
        // proceed with claims-based logic
        return c.Render(200, r.H{"user": claims["sub"]})
    }
}

func Bootstrap() *buffalo.App {
    app := buffalo.New(buffalo.Options{
        Env:         ENV,
        SessionStore: &middleware.SessionCookieStore{},
    })
    app.GET("/", Home(), middleware.JWTWithHostCheck(secretKey, "api.example.com"))
    return app
}

Additional Hardening Tips

• Set the SameSite attribute on cookies used for token storage to Lax or Strict where appropriate.
• Validate the HTTP Referer header as an additional layer, but do not rely on it alone since it can be stripped.
• Use short-lived JWTs and refresh token rotation to limit the impact of token leakage via rebinding.
• Employ network-level controls in deployment (e.g., restricting which interfaces an endpoint listens on) to reduce the effective attack surface exposed by DNS rebinding.

These fixes ensure that JWT validation is bound to the expected network context, mitigating the risk that a valid token is accepted for requests that reach internal or unintended endpoints.