Dns Rebinding in Echo Go with Hmac Signatures

DNS Rebinding is an attack where a malicious page resolves a domain to an attacker-controlled IP, then switches the DNS answer to a different IP (often a local or internal address) within the same session. When an API service uses HMAC signatures only for request authentication but does not adequately validate the request origin or host, a browser-based attacker can drive a victim’s client to make signed requests to internal endpoints that the server trusts based on the HMAC, but not on the network origin.

In Echo Go, if you validate HMAC signatures on incoming requests but rely on the Host header or a URL prefix to decide whether the request is internal or external, a Rebinding scenario can bypass intended network-level trust. An attacker can craft a page that makes a request to your public endpoint with a valid HMAC (because the shared secret is used correctly), but the Host header can be made to match an allowed internal hostname after the DNS swap. Echo does not inherently tie the HMAC validation to a verified server identity or a strict source binding, so the request appears legitimate even though the client was redirected to a different network location.

Consider an endpoint that uses HMAC signatures to protect administrative actions and trusts requests with a specific hostname header. An attacker can get a victim to load JavaScript that performs a sequence of requests to the public URL. The HMAC is valid because the parameters and secret are correct, but the effective network destination has changed to a local service (e.g., 127.0.0.1:8080/internal/reset). Because Echo Go does not enforce that the request originates from a network zone you control, and does not pin the server identity beyond the HMAC, the rebinding path can make internal services reachable through the public-facing API surface.

To detect this class of issue using middleBrick, you can submit the public API URL for a scan. The tool checks for missing origin validation, Host header misuse, and weak binding between the authenticated request context and the network destination. The findings will highlight whether your HMAC implementation is coupled with network-level or identity-level checks, and will provide remediation guidance to reduce the attack surface exposed by DNS Rebinding.

Remediation centers on ensuring that HMAC validation is bound to more than the canonical request string; you must also verify the request destination and origin. Below are concrete code examples for Echo Go that show how to implement HMAC validation safely, including host verification and optional channel-binding to reduce DNS Rebinding risk.

Example 1: Strict HMAC validation with Host and method check

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"fmt"
	"net/http"
	"strings"

	"github.com/labstack/echo/v4"
)

const sharedSecret = "very-secret-shared-key"

func isValidHMAC(r *http.Request, expectedSignature string) bool {
	mac := hmac.New(sha256.New, []byte(sharedSecret))
	mac.Write([]byte(r.Method + "\n"))
	mac.Write([]byte(r.URL.RequestURI() + "\n"))
	mac.Write([]byte(r.Host + "\n"))
	// optionally include a request timestamp and validate freshness to prevent replay
	computed := fmt.Sprintf("%x", mac.Sum(nil))
	return hmac.Equal([]byte(computed), []byte(expectedSignature))
}

func hmacMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		req := c.Request()
		// Accept signature from a dedicated header to avoid collisions
		sig := req.Header.Get("X-API-Signature")
		if sig == "" {
			return echo.NewHTTPError(http.StatusBadRequest, "missing signature")
		}
		// Bind to an allowed host to mitigate DNS rebinding
		allowedHosts := map[string]bool{"api.example.com": true, "app.example.com": true}
		if !allowedHosts[req.Host] {
			return echo.NewHTTPError(http.StatusForbidden, "host not allowed")
		}
		if !isValidHMAC(req, sig) {
			return echo.NewHTTPError(http.StatusUnauthorized, "invalid signature")
		}
		return next(c)
	}
}

func adminHandler(c echo.Context) error {
	return c.String(http.StatusOK, "admin action authorized")
}

func main() {
	e := echo.New()
	e.Use(hmacMiddleware)
	e.GET("/admin/reset", adminHandler)
	e.Logger.Fatal(e.Start(":8080"))
}

Example 2: Include request timestamp and nonce to prevent replay after rebinding

import (
	"time"
)

func isValidHMACWithTime(r *http.Request, expectedSignature string, clockSkewSeconds int64) bool {
	timestamp := r.Header.Get("X-Request-Timestamp")
	if timestamp == "" {
		return false
	}
	// Reject requests too far from server time to mitigate replay via rebinding
	ts, err := time.Parse(time.RFC3339, timestamp)
	if err != nil {
		return false
	}
	if time.Since(ts).Abs() > time.Duration(clockSkewSeconds)*time.Second {
		return false
	}
	mac := hmac.New(sha256.New, []byte(sharedSecret))
	mac.Write([]byte(r.Method + "\n"))
	mac.Write([]byte(r.URL.RequestURI() + "\n"))
	mac.Write([]byte(r.Host + "\n"))
	mac.Write([]byte(timestamp + "\n"))
	// optional nonce header to ensure uniqueness per request
	nonce := r.Header.Get("X-Request-Nonce")
	if nonce == "" {
		return false
	}
	mac.Write([]byte(nonce + "\n"))
	computed := fmt.Sprintf("%x", mac.Sum(nil))
	return hmac.Equal([]byte(computed), []byte(expectedSignature))
}

Operational and architectural mitigations

• Bind HMAC scope to the expected host and, where possible, to the server’s network identity (e.g., enforce that requests arrive on the interface you expect).
• Use short-lived nonces or timestamps to prevent replay attacks that rely on rebinding to a different service path.
• Do not rely on Host-based trust alone; combine HMAC validation with transport-level constraints (mTLS where feasible) and explicit allowlists for target hosts and IPs.
• In CI/CD, add middleBrick GitHub Action to fail builds if risk scores for API Security are above your chosen threshold, so misconfigurations like weak HMAC usage are caught before deployment.

By tying HMAC validation to explicit host checks and optional freshness/nonce checks, you reduce the window an attacker gains from DNS Rebinding when using Echo Go. These changes ensure that even if a victim’s browser is redirected, the server will reject requests that do not meet strict origin and identity criteria.