Dns Rebinding in Flask with Bearer Tokens

DNS rebinding is a client-side attack that manipulates DNS responses to make a browser believe a remote host is reachable at an attacker-controlled IP. When combined with Bearer Token authentication in a Flask API, the risk is compounded because a victim’s browser may automatically include Authorization headers for the target origin, even when the IP address changes between requests.

Consider a Flask API that uses Bearer Tokens in the Authorization header and does not enforce strict origin or host validation. An attacker can craft a page that resolves a domain (e.g., api.example.com) to an attacker IP, then quickly re-resolves it to localhost or another internal address. If the browser sends cached credentials or cookies and the Flask app relies solely on the presence of a Bearer token without validating the request origin, the browser may include the token for the rebound IP. This can bypass same-origin protections and expose token-bound endpoints to unauthorized actions.

In practice, this means an authenticated session using a Bearer token can be abused across network boundaries. For example, an endpoint like /admin/delete that expects a valid Authorization header may be invoked from a malicious site because the browser treats the rebounded IP as the same origin. Flask applications that parse and trust the Host header or do not validate the token scope against the request source are especially vulnerable.

middleBrick scans such combinations during unauthenticated black-box testing, checking for missing host-binding controls and token handling issues across the 12 security checks. Although middleBrick detects and reports these risks with remediation guidance, it does not fix, patch, or block the behavior; it only highlights where defenses are weak.

Real-world references include common findings mapped to OWASP API Top 10 and can align with items like Broken Object Level Authorization (BOLA) when token usage is insufficiently scoped. The scanner also flags missing anti-rebinding protections under Property Authorization and Unsafe Consumption checks.

To mitigate DNS rebinding when using Bearer Tokens in Flask, enforce strict origin validation, avoid relying on the Host header for security decisions, and validate token scope per request. Below are concrete, working examples.

First, ensure your Flask app validates the Host header explicitly and rejects requests with unexpected hosts:

from flask import Flask, request, abort

app = Flask(__name__)

VALID_HOSTS = {"api.example.com", "staging.api.example.com"}

@app.before_request
def validate_host():
    if request.host not in VALID_HOSTS:
        abort(403, "Host not allowed")

Second, require strict Origin or Referer checks for state-changing methods, and do not automatically trust the Authorization header without context:

from flask import request

@app.before_request
def require_auth_origin():
    allowed_origins = {"https://app.example.com"}
    origin = request.headers.get("Origin")
    referer = request.headers.get("Referer")
    if request.method in ("POST", "PUT", "DELETE"):
        if origin not in allowed_origins and (not referer or not referer.startswith("https://app.example.com")):
            abort(403, "Invalid origin or referer")
    # Validate Bearer token format but do not grant access based on token alone
    auth = request.headers.get("Authorization")
    if auth and not auth.startswith("Bearer "):
        abort(401, "Invalid authorization header format")

Third, scope Bearer tokens to specific origins or audiences and validate them server-side. When issuing tokens, include an audience claim and verify it on each request:

from flask import request, jsonify
import jwt

AUDIENCE = "api.example.com"
SECRET_KEY = "your-secret-key"

@app.route("/protected")
def protected():
    auth = request.headers.get("Authorization")
    if not auth or not auth.startswith("Bearer "):
        abort(401, "Missing or invalid token")
    token = auth.split(" ")[1]
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"], audience=AUDIENCE)
        # proceed with request handling using payload["sub"] or similar
        return jsonify({"user": payload.get("sub")})
    except jwt.ExpiredSignatureError:
        abort(401, "Token expired")
    except jwt.InvalidAudienceError:
        abort(403, "Invalid token audience")
    except jwt.InvalidTokenError:
        abort(401, "Invalid token"

These examples demonstrate defense-in-depth: host binding, origin validation, and token audience verification. They reduce the attack surface for DNS rebinding by ensuring that a Bearer token is not sufficient alone and that request context is consistently validated.

middleBrick can highlight where such controls are missing during scans, providing prioritized findings with severity and remediation steps. The platform supports OpenAPI/Swagger spec analysis, which helps verify that security expectations like host constraints and required headers are documented and aligned with runtime behavior.