Dns Rebinding in Koa with Hmac Signatures

DNS Rebinding is a client-side network attack that manipulates DNS responses to make a browser send requests to an IP address that differs from the originally resolved hostname. In a Koa application that relies on Hmac Signatures for request authentication, this technique can bypass intended origin checks when the server uses hostnames for validation but does not sufficiently verify the resolved IP or bind checks to a strict source context.

Consider a Koa endpoint that validates an Hmac Signature derived from a shared secret and selected request properties, including a hostname header or the request host. An attacker crafts a webpage that first resolves a benign domain (e.g., api.example.com) to an attacker-controlled IP, then switches the DNS response to a private IP such as 127.0.0.1 or an internal service IP. The victim’s browser continues to send requests with the original hostname in headers like Host, and if the Koa service uses that hostname to compute or verify the Hmac without also validating the actual destination IP, the signature may still appear valid.

The vulnerability is specific to the combination of Koa routing and Hmac verification logic that trusts the request host implicitly. For example, if the Hmac is computed over a canonical string that includes the hostname but not the resolved IP or a server-side binding to an allowed list of targets, an attacker on a shared network or via a compromised DNS resolver can reroute traffic to internal endpoints. This can lead to unauthorized actions being performed under the guise of a trusted origin, especially when the endpoint performs sensitive operations based on parsed request data or forwards requests internally.

Because middleBrick scans APIs without authentication and tests unauthenticated attack surfaces, it can surface findings related to input validation and request handling that highlight weak host-based checks, even when Hmac Signatures are in use. The tool’s checks for Input Validation and Property Authorization help identify whether hostname-based controls are insufficient and whether additional binding to IP or strict allowlists is missing.

To mitigate DNS Rebinding risks when using Hmac Signatures in Koa, you must bind the signature verification to a strict, server-side expected origin or IP, rather than relying on client-supplied hostnames. The following patterns demonstrate how to implement robust verification in a Koa application using the crypto module.

1. Fixed expected origin with Hmac verification

Define a single expected hostname or IP on the server, and use it both for routing decisions and for validating the Hmac. Do not trust ctx.request.host for security-critical checks.

const Koa = require('koa');
const crypto = require('crypto');

const app = new Koa();
const EXPECTED_HOST = 'api.example.com';
const SHARED_SECRET = process.env.SHARED_SECRET; // store securely

function verifyHmac(req) {
  const signature = req.headers['x-signature'];
  const timestamp = req.headers['x-timestamp'];
  if (!signature || !timestamp) return false;
  const payload = `${timestamp}:${EXPECTED_HOST}:${req.method}:/api/resource`;
  const expected = crypto.createHmac('sha256', SHARED_SECRET).update(payload).digest('hex');
  // Use timing-safe compare
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

app.use(async (ctx, next) => {
  if (!verifyHmac(ctx)) {
    ctx.status = 401;
    ctx.body = { error: 'invalid signature' };
    return;
  }
  // Optionally enforce host header matches expected origin
  if (ctx.request.host !== EXPECTED_HOST) {
    ctx.status = 400;
    ctx.body = { error: 'host not allowed' };
    return;
  }
  await next();
});

app.post('/api/resource', (ctx) => {
  ctx.body = { ok: true };
});

app.listen(3000);

2. IP-binding variant for internal services

If your endpoint is only intended for internal consumers, bind to a specific local address and validate that the connection arrives from an allowed IP, in addition to Hmac checks.

const net = require('net');

const ALLOWED_IPS = new Set(['10.0.0.5', '192.168.1.10']);

function isAllowedIp(socket) {
  return ALLOWED_IPS.has(socket.remoteAddress.replace(/^::ffff:/, ''));
}

app.use(async (ctx, next)n) {
  if (!isAllowedIp(ctx.socket)) {
    ctx.status = 403;
    ctx.body = { error: 'ip not allowed' };
    return;
  }
  await next();
});

These examples emphasize that Hmac Signatures should incorporate a server-controlled scope (hostname or IP) and that runtime checks should compare against fixed values rather than dynamic request host headers. middleBrick’s checks for Input Validation and Property Authorization can help detect whether such binding is missing in your API configuration.