Memory Leak in Fiber with Api Keys

A memory leak in a Fiber application that handles API keys can arise when key objects are retained in memory longer than necessary. In Go, memory is managed by garbage collection, but references held in global variables, caches, or request-scoped contexts can prevent the collector from reclaiming memory. When API keys are stored in structures that remain reachable—such as a global map keyed by request ID, a middleware context, or an in-memory cache without eviction—they accumulate over time, increasing the heap size and potentially degrading performance.

Fiber uses context values to pass request-scoped data. If API keys are attached to the context without cleanup, or if response writers or request bodies hold references to key material, each request contributes a small leak. Over many requests, these small leaks manifest as steady memory growth. This is especially relevant when the application caches or logs API keys, retains middleware state across requests, or fails to release buffers associated with large key payloads. The unauthenticated attack surface tested by middleBrick includes input validation and data exposure checks, which can surface indicators of such retention patterns.

Because API keys often appear in structured data (e.g., JSON payloads, headers, or URL parameters), improper schema handling can cause repeated allocations. For instance, unmarshaling into new structs on every request while keeping references in a global registry creates cycles or stale entries. The LLM/AI security checks do not directly test memory behavior, but the broader scan for input validation and data exposure can highlight endpoints that mishandle key material, indirectly pointing to retention issues.

In a production-like environment monitored through the middleBrick Web Dashboard, a gradual increase in memory usage across scans may correlate with findings tied to insecure key handling. While the scanner does not perform runtime memory profiling, its prioritization of data exposure and authentication findings can guide developers to review how keys are stored and released. Observability through the Dashboard can help track whether remediation reduces resource growth over time.

Real-world patterns include storing keys in a sync.Map without TTL or attaching them to a request context that is never canceled. Attack patterns such as resource exhaustion may be indirectly inferred when improper key handling leads to unbounded memory growth, a concern aligned with data exposure findings mapped to frameworks like OWASP API Top 10.

To mitigate memory leaks when handling API keys in Fiber, focus on limiting object lifetimes, avoiding unnecessary retention, and ensuring proper cleanup. Use request-scoped storage carefully and prefer passing values as arguments rather than storing them in long-lived structures.

Example: Safe API key handling without global retention

package main

import (
	"fmt"
	"net/http"

	"github.com/gofiber/fiber/v2"
)

type keyInfo struct {
	Value string
}

// extractKey reads the API key from headers and returns a keyInfo value.
// It does not store the key beyond the request handling.
func extractKey(c *fiber.Ctx) (keyInfo, error) {
	raw := c.Get("X-API-Key")
	if raw == "" {
		return keyInfo{}, fmt.Errorf("missing API key")
	}
	return keyInfo{Value: raw}, nil
}

func main() {
	app := fiber.New()

	app.Use(func(c *fiber.Ctx) error {
		info, err := extractKey(c)
		if err != nil {
			return c.Status(http.StatusUnauthorized).SendString("Unauthorized")
		}
		// Use info.Value within the request lifecycle only.
		// Do not assign info to a global or long-lived cache.
		c.Locals("keyInfo", info) // request-scoped, cleared after response
		return c.Next()
	})

	app.Get("/resource", func(c *fiber.Ctx) error {
		info, ok := c.Locals("keyInfo").(keyInfo)
		if !ok {
			return c.SendStatus(http.StatusInternalServerError)
		}
		// Process the request using info.Value without retaining it.
		return c.JSON(fiber.Map{"status": "ok", "keyLength": len(info.Value)})
	})

	app.Listen(":3000")
}

Example: Controlled caching with TTL to prevent unbounded growth

package main

import (
	"fmt"
	"sync"
	"time"

	"github.com/gofiber/fiber/v2"
)

type cachedKey struct {
	Value      string
	Expiration int64
}

var (
	keyCache = make(map[string]cachedKey)
	cacheMu  sync.Mutex
	// Define a reasonable TTL to bound memory growth.
	const ttl = 5 * time.Minute
)

// cleanCache periodically removes expired entries.
func cleanCache() {
	for range time.Tick(1 * time.Minute) {
		cacheMu.Lock()
		now := time.Now().Unix()
		for k, v := range keyCache {
			if now >= v.Expiration {
				delete(keyCache, k)
			}
		}
		cacheMu.Unlock()
	}
}

func main() {
	go cleanCache()

	app := fiber.New()

	app.Post("/register-key", func(c *fiber.Ctx) error {
		var payload struct {
			Key string `json:"key"`
		}
		if err := c.BodyParser(&payload); err != nil {
			return c.Status(http.StatusBadRequest).SendString("Invalid payload")
		}
		cacheMu.Lock()
		keyCache[payload.Key] = cachedKey{
			Value:      payload.Key,
			Expiration: time.Now().Add(ttl).Unix(),
		}
		cacheMu.Unlock()
		return c.SendStatus(http.StatusNoContent)
	})

	app.Get("/check-key", func(c *fiber.Ctx) error {
		key := c.Query("k")
		cacheMu.Lock()
		entry, found := keyCache[key]
		cacheMu.Unlock()
		if !found || time.Now().Unix() > entry.Expiration {
			return c.SendStatus(http.StatusNotFound)
		}
		// Use entry.Value safely within request scope; do not retain beyond response.
		return c.JSON(fiber.Map{"valid": true})
	})

	app.Listen(":3000")
}

Best practices summary

• Avoid global maps or caches for API keys unless strictly necessary, and always pair them with eviction policies (TTL).
• Prefer passing key information as function arguments rather than storing in request context for extended periods.
• Do not log or serialize API keys; if logging is required for auditing, mask or hash the values.
• Ensure response writers do not inadvertently retain references to key material through closures or deferred functions.
• Use the middleBrick CLI (middlebrick scan <url>) to validate input handling and data exposure, and consider the Pro plan for continuous monitoring that can surface regressions over time.