Dns Rebinding in Chi with Api Keys

Dns Rebinding is a client-side network attack that manipulates DNS responses to make a browser believe a remote host is reachable at an attacker-controlled IP after the initial page load. In Chi, a common Go HTTP router, this becomes relevant when API endpoints rely on Api Keys for authorization but do not enforce same-origin or referrer checks. A typical pattern in Chi looks like r.Get("/api/resource", apiKeyMiddleware, handler). If the handler trusts the Host header or returns URLs that the client subsequently uses, an attacker can serve a page that causes the browser to send requests to internal services using the victim’s Api Key, bypassing network-level isolation.

When Api Keys are passed via headers (e.g., Authorization: ApiKey {key}) and the server uses the Host header to construct redirect or callback URLs, Dns Rebinding can trick the client into sending credentials to an internal IP. For example, an endpoint that returns a redirect with http://internal-host:8080/export may be resolved by the client to an attacker’s machine after a rebind, while still carrying the Api Key. Because Chi does not inherently validate that the Host or Origin matches an allowed set, the unauthenticated attack surface includes these cross-origin scenarios, and findings from middleBrick’s BOLA/IDOR and Property Authorization checks often surface this misconfiguration.

middleBrick’s unauthenticated scan would flag such endpoints under the Property Authorization and Input Validation checks, noting that the API does not enforce strict host binding or validate the Origin header when Api Keys are used. This exposes an insecure direct object reference pattern where the key is accepted but the request context is not sufficiently constrained. The scanner also highlights missing referrer policies and SSRF-related risks when internal IPs become reachable through rebinding, aligning with the tool’s detections for SSRF and Unsafe Consumption checks.

To mitigate Dns Rebinding in Chi when using Api Keys, enforce strict host and origin validation before processing any request. Middleware should compare the Host header against an allowlist and verify the Origin or Referer headers where applicable. Below is a minimal, realistic middleware example in Go that you can integrate into your Chi routes:

package main

import (
	"net/http"
	"strings"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

func apiKeyMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// Validate Host to prevent DNS rebinding
		allowedHosts := map[string]bool{
			"api.example.com": true,
			"staging.api.example.com": true,
		}
		if !allowedHosts[r.Host] {
			http.Error(w, "host not allowed", http.StatusForbidden)
			return
		}

		// Validate Origin/Referer for cross-origin requests
		origin := r.Header.Get("Origin")
		if origin != "" && !strings.HasPrefix(origin, "https://api.example.com") {
			http.Error(w, "invalid origin", http.StatusForbidden)
			return
		}

		apiKey := r.Header.Get("Authorization")
		if apiKey == "" || !isValidApiKey(apiKey) {
			http.Error(w, "unauthorized", http.StatusUnauthorized)
			return
		}

		// Pass request to next handler if checks pass
		next.ServeHTTP(w, r)
	})
}

func isValidApiKey(key string) bool {
	// Replace with secure key lookup, e.g., constant-time compare against a store
	return key == "Bearer YOUR_VALID_API_KEY"
}

func main() {
	r := chi.NewRouter()
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(apiKeyMiddleware)

	r.Get("/api/resource", func(w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("secure data"))
	})

	http.ListenAndServe(":8080", r)
}

Additionally, configure your DNS and server to avoid exposing internal services on public interfaces and set Referrer-Policy and Cross-Origin-Opener-Policy headers in responses. middleBrick’s GitHub Action can be added to your CI/CD pipeline to fail builds if a scan detects missing host validation or unsafe CORS configurations, ensuring that Dns Rebinding risks are caught before deployment.

For ongoing protection, use the middleBrick CLI to scan your endpoints regularly: middlebrick scan https://api.example.com. The dashboard can track these checks over time, and the Pro plan’s continuous monitoring can schedule scans to alert you if a new endpoint introduces permissive CORS or Host rules that could enable rebinding with Api Keys.