Man In The Middle in Gin with Bearer Tokens

A Man In The Middle (MitM) attack against an API built with Gin that uses Bearer Tokens occurs when an attacker can intercept or alter traffic between the client and the server. Because Bearer Tokens are typically transmitted in the Authorization header, interception grants the attacker a valid credential that can be reused to impersonate the victim. In Gin, this risk commonly arises when routes that accept Authorization bearer tokens are served over unencrypted HTTP, when TLS is inconsistently enforced, or when token handling logic in middleware is incomplete or inconsistent.

For example, if a Gin route is defined to require a Bearer Token but the server does not redirect HTTP to HTTPS, an on-path attacker can observe the token in cleartext during the initial HTTP request. Even when TLS is used, implementation issues such as missing secure cookie flags, improper CORS configurations, or accepting connections on multiple ports can expose the token in transit. The Gin framework itself does not introduce the vulnerability, but common usage patterns—such as skipping HTTPS redirects or failing to validate the Authorization header format—expand the attack surface.

During a black-box scan, tools like middleBrick’s Authentication and Data Exposure checks evaluate whether endpoints that accept Bearer Tokens are served over unencrypted channels, whether tokens are transmitted in URLs or logs, and whether server responses include protections like strict Transport Security or secure header configurations. Inconsistent middleware ordering is another subtle risk: if authentication middleware is placed after routes that inadvertently expose tokens in error messages or logs, an attacker may leverage information disclosure to refine interception strategies.

Real-world attack patterns include session hijacking via captured tokens, replay of intercepted requests, and privilege escalation when a low-privilege token is reused across scopes. Because Bearer Tokens are static until expiration, intercepted tokens remain valuable until rotation or revocation occurs. OWASP API Security Top 10 categories such as Broken Object Level Authorization and Security Misconfiguration are often observed in conjunction with MitM risks when transport protections or token handling are weak.

Using middleBrick’s scans, teams can identify whether their Gin endpoints leak tokens in cleartext, whether TLS is consistently enforced, and whether security headers like Strict-Transport-Security and proper CORS settings are present. The scanner’s parallel checks highlight inconsistencies in how authentication is enforced across the API surface, helping teams understand where unauthenticated or insufficiently protected endpoints expose Bearer Token–based flows.

Remediation focuses on ensuring Bearer Tokens are never transmitted or stored insecurely and that Gin routes consistently enforce authenticated, encrypted communication. The following code examples demonstrate secure patterns for Bearer Token handling in Gin, including middleware validation, HTTPS redirection, and secure header usage.

1. Enforce HTTPS and redirect HTTP to HTTPS

Ensure all traffic uses TLS by redirecting HTTP to HTTPS and adding Strict-Transport-Security headers.

package main

import (
	"net/http"

	"github.com/gin-gonic/gin"
)

func main() {
	r := gin.New()

	// Enforce HTTPS for all requests
	r.Use(func(c *gin.Context) {
		if c.Request.TLS == nil {
			c.Request.URL.Scheme = "https"
			c.Request.URL.Host = c.Request.Header.Get("X-Forwarded-Host")
			c.AbortWithStatusJSON(http.StatusMovedPermanently, gin.H{
				"error": "use HTTPS",
			})
			return
		}
		c.Next()
	})

	// HSTS header for browsers
	r.Use(gin.SecurityHeadersMiddleware(), func(c *gin.Context) {
		c.Writer.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
		c.Next()
	})

	// Protected route example
	r.GET("/resource", authMiddleware(), func(c *gin.Context) {
		c.JSON(http.StatusOK, gin.H{"message": "secure data"})
	})

	r.RunTLS(":443", "server.crt", "server.key")
}

func authMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		auth := c.GetHeader("Authorization")
		if auth == "" {
			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "authorization header required"})
			return
		}

		const bearerPrefix = "Bearer "
		if len(auth) < len(bearerPrefix) || auth[:len(bearerPrefix)] != bearerPrefix {
			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid authorization header format"})
			return
		}

		token := auth[len(bearerPrefix):]
		if token == "" {
			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "token missing"})
			return
		}

		// TODO: validate token (e.g., JWT verification, introspection)
		c.Set("token", token)
		c.Next()
	}
}

2. Validate Bearer Token format and reject malformed values

Ensure the Authorization header strictly follows the Bearer token format to prevent injection or parsing issues.

func authMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		auth := c.GetHeader("Authorization")
		if auth == "" {
			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "authorization header required"})
			return
		}

		// Reject multiple schemes or malformed values
		// This simple check prevents "BearerTokenWithoutSpace" or "Basic " misuse
		var token string
		n, err := fmt.Sscanf(auth, "Bearer %s", &token)
		if err != nil || n != 1 || token == "" {
			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "malformed authorization header"})
			return
		}

		// Placeholder for token validation logic
		c.Set("token", token)
		c.Next()
	}
}

3. Avoid logging or exposing tokens

Ensure tokens are not written to logs, and responses do not inadvertently include sensitive headers.

func secureLogger() gin.HandlerFunc {
	return func(c *gin.Context) {
		// Skip logging Authorization header
		cl := c.Copy()
		cl.Request.Header.Del("Authorization")
		c.Next()
	}
}

4. Use secure CORS and referrer policies

Prevent token leakage via cross-origin requests or referrer headers by tightening CORS and referrer policies.

r.Use(cors.New(cors.Config{
	AllowOrigins:     []string{"https://trusted.example.com"},
	AllowMethods:     []string{"GET", "POST", "OPTIONS"},
	AllowHeaders:     []string{"Origin", "Content-Type", "Authorization"},
	ExposeHeaders:    []string{"Content-Length"},
	AllowCredentials: true,
	MaxAge:           12 * time.Hour,
}))

Combining these practices—HTTPS enforcement, strict Bearer Token validation, avoiding token leakage in logs, and tightening CORS—reduces the surface area for MitM attacks targeting Bearer Tokens in Gin APIs. Security headers like Strict-Transport-Security and careful middleware ordering further harden the API against interception and token reuse.