Nosql Injection in Chi with Api Keys

Chi is a lightweight HTTP routing library for Go, commonly used to build APIs. When API keys are implemented as static query parameters, headers, or cookies without additional validation, they can affect the request routing and parameter handling in ways that interact with database query construction. If a Chi endpoint passes user-controlled data — such as an API key value or a parameter derived from it — into a NoSQL database query without proper sanitization or type conversion, the input may be interpreted as part of the query language rather than literal data.

For example, a route defined with chi.Router might extract an API key from a header and use it to build a DynamoDB expression or a MongoDB filter. If the key value is concatenated into a JSON string or passed through string-based query building, special characters such as operators ($, :, {, }) can change the structure of the resulting NoSQL statement. This can lead to unauthorized data access, data exfiltration, or condition bypass when the effective query differs from the intended logic.

In a black-box scan performed by middleBrick, unauthenticated endpoints that accept an API key in headers or query parameters are tested for injection patterns by injecting structured payloads such as {'$ne': ''} or {'$where': 'true'} into the parameter space. If the backend reflects these values into a NoSQL context without validation, the scan can detect unexpected behavior such as missing authentication enforcement or data exposure. Because API keys are often high-value targets, an attacker who can manipulate how they are used in a NoSQL context may bypass intended access controls or escalate privileges across logical tenant boundaries.

middleBrick’s LLM/AI Security checks are not relevant to this category, but its standard security checks — including BOLA/IDOR, Input Validation, and Property Authorization — are designed to surface these classes of issue. The scanner correlates findings with the OpenAPI specification when available, highlighting parameters derived from authentication material and showing how they flow into database operations. This helps teams understand whether an API key is being treated as data rather than as a credential, reducing the likelihood of a successful NoSQL Injection in Chi deployments.

Secure handling of API keys in Chi requires treating the key as an opaque credential rather than as queryable data. Keys should be validated against a trusted store before any request processing, and never be incorporated into dynamic NoSQL queries. Below are concrete code examples that demonstrate safe patterns.

Example 1: Validate API key without using its value in queries

package main

import (
    "context"
    "net/http"

    "github.com/go-chi/chi/v5"
)

// isValidAPIKey checks the key against a secure store (e.g., database, vault).
// It returns the associated tenant ID if valid, or empty string if invalid.
func isValidAPIKey(key string) (string, bool) {
    // In production, replace this with a secure lookup.
    validKeys := map[string]string{
        "abc123": "tenant-1",
        "def456": "tenant-2",
    }
    tenant, ok := validKeys[key]
    return tenant, ok
}

func main() {
    r := chi.NewRouter()

    r.Use(func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            key := r.Header.Get("X-API-Key")
            if key == "" {
                http.Error(w, "missing API key", http.StatusUnauthorized)
                return
            }
            tenantID, ok := isValidAPIKey(key)
            if !ok {
                http.Error(w, "invalid API key", http.StatusUnauthorized)
                return
            }
            // Store tenantID in context for downstream handlers; do not use key in queries.
            ctx := context.WithValue(r.Context(), "tenantID", tenantID)
            next.ServeHTTP(w, r.WithContext(ctx))
        })
    })

    r.Get("/data", func(w http.ResponseWriter, r *http.Request) {
        tenantID := r.Context().Value("tenantID").(string)
        // Use tenantID as a literal value in a parameterized query, never concatenate.
        // Example for a SQL/NoSQL driver that supports placeholders.
        // collection.Find(ctx, bson.M{"tenant_id": tenantID})
        w.Write([]byte("data for tenant: " + tenantID))
    })

    http.ListenAndServe(":8080", r)
}

Example 2: Reject keys containing suspicious characters early

func sanitizeAndValidate(key string) (string, error) {
    // Reject keys that contain characters not expected in a token.
    if containsSpecial(key) {
        return "", fmt.Errorf("invalid key format")
    }
    return key, nil
}

func containsSpecial(s string) bool {
    for _, ch := range s {
        if ch == '$' || ch == '{' || ch == '}' || ch == ':' {
            return true
        }
    }
    return false
}

By validating and isolating the API key, you prevent it from being interpreted as part of a NoSQL expression. middleBrick’s CLI can be used to verify that endpoints requiring keys do not reflect untrusted input in database-related responses. Run middlebrick scan <url> to see whether any findings highlight parameter flows that could enable injection.