Missing Tls in Chi with Api Keys

Transport Layer Security (TLS) ensures confidentiality and integrity in transit. When a Chi API service handling API keys does not enforce TLS, keys can be observed in cleartext across the network. This combination is common in services that accept key material via headers or query parameters while listening on plain HTTP. middleBrick scans such endpoints and flags Missing TLS as a high-severity finding because unencrypted transport exposes static keys to interception, session hijacking, and replay.

In Chi, a typical pattern is to read keys from request headers for authorization. If the server is configured without HTTPS, an on-path attacker can capture those headers using network sniffing or compromised infrastructure. The risk is elevated when keys grant access to downstream services or sensitive data, aligning with BFLA/Privilege Escalation and Data Exposure checks in middleBrick’s 12-test suite. Attack patterns observed in the wild include credential theft via ARP spoofing or unprotected load balancer paths.

middleBrick’s unauthenticated scan detects Missing TLS by verifying that all entrypoints—especially those documented with key-bearing schemes—respond only over HTTP. It cross-references the OpenAPI spec, resolving $ref definitions to ensure security schemes requiring keys are served with encryption. Findings include a per-category breakdown with severity and remediation guidance, helping teams understand exposure without assuming internal architecture.

Remediation centers on enforcing HTTPS for all routes and ensuring keys are never transmitted over plaintext channels. In Chi, you configure the HTTP server to use TLS and apply secure middleware to validate incoming requests. Below are concrete, working examples using the chi router and the standard Go http package.

1) Configure TLS-enabled Chi router

Generate or obtain a certificate and private key (e.g., via Let’s Encrypt). Use http.ListenAndServeTLS with your Chi handler. This ensures all API traffic, including API key headers, is encrypted in transit.

// main.go
package main

import (
	"log"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

func main() {
	r := chi.NewRouter()
	r.Use(middleware.Logger)
	r.Use(middleware.Recoverer)

	// Example secure endpoint that expects an API key in a header
	r.Get("/protected", func(w http.ResponseWriter, r *http.Request) {
		apiKey := r.Header.Get("X-API-Key")
		if apiKey == "" {
			http.Error(w, "missing api key", http.StatusUnauthorized)
			return
		}
		// Validate apiKey against a secure store before proceeding
		w.Write([]byte("access granted"))
	})

	// Enforce HTTPS with TLS certificates
	log.Println("Server listening on :443")
	log.Fatal(http.ListenAndServeTLS(":443", "server.crt", "server.key", r))
}

2) Enforce HTTPS redirects and secure headers

Add middleware to redirect HTTP to HTTPS and set security headers that mitigate downgrade risks. This complements TLS enforcement and protects API keys from being leaked via insecure origins.

// redirect.go
package main

import (
	"net/http"

	"github.com/go-chi/chi/v5"
)

func redirectHTTPToHTTPS(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.TLS == nil {
			http.Redirect(w, r, "https://"+r.Host+r.RequestURI, http.StatusMovedPermanently)
			return
		}
		next.ServeHTTP(w, r)
	})
}

func secureHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
		next.ServeHTTP(w, r)
	})
}

func main() {
	r := chi.NewRouter()
	r.Use(secureHeaders)
	r.Use(middleware.Logger)

	r.Get("/health", func(w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("ok"))
	})

	// Chain redirect and router
	http.ListenAndServe(":80", redirectHTTPToHTTPS(r))
}

3) Validate API keys securely over TLS

Even with TLS, validate keys server-side using constant-time comparison to avoid timing attacks. Store hashed keys and verify them before granting access to protected Chi routes.

// auth.go
package main

import (
"crypto/subtle"
"net/http"
)

const expectedKey = "s3cr3tK3yH4sh3d" // In practice, store a hash

func requireAPIKey(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	provided := r.Header.Get("X-API-Key")
	if subtle.ConstantTimeCompare([]byte(provided), []byte(expectedKey)) != 1 {
		http.Error(w, "forbidden", http.StatusForbidden)
		return
	}
	next.ServeHTTP(w, r)
})
}

// Usage: r.Use(requireAPIKey)

These examples demonstrate how to integrate TLS enforcement and secure API key handling directly in Chi. middleBrick’s CLI can validate that your endpoints now require HTTPS and that security headers are present, reducing the risk of key exposure.