Nosql Injection in Chi with Jwt Tokens

Nosql Injection occurs when user-controlled input is interpreted as part of a NoSQL query without proper validation or parameterization. In a Chi application that uses JWT Tokens for authentication, combining dynamic query construction with JWT-based authorization can expose sensitive data or allow privilege escalation if the token payload is not strictly validated and the query logic is not isolated from untrusted input.

Chi is a Clojure web library that does not include built-in database abstractions; developers typically integrate with databases using libraries such as next.jdbc or HoneySQL. When JWT Tokens are used to carry user roles or scopes, those claims are often parsed and then used to filter records (for example, tenant_id or user_id). If the values extracted from the JWT Token are directly interpolated into a NoSQL query map or concatenated into a JSON selector, an attacker may manipulate the token or the downstream query to bypass intended filters.

For example, consider a route that extracts a tenant identifier from a JWT Token and uses it to scope documents in a document store. If the application builds a query like {"$and" [{:tenant_id tenant} {:status "active"}]} by inserting the tenant value directly from the token, and the token is not cryptographically verified for each query, an attacker who can influence the token or the surrounding logic may inject additional conditions such as {"$where": "return true"} or modify the structure to leak other tenants’ data. Even when using JWT Tokens with verified signatures, if the application trusts claims for query construction without re-validating against a server-side store, the attack surface remains open.

Chi routes often pattern-match request contexts and extract parameters or headers manually. If a developer extracts a subject identifier from a JWT Token and uses it to form a NoSQL query key without normalization or type checks, malformed input can change the query semantics. For instance, injection through JSON paths or update pipelines can occur when user-controlled fields from the request are merged into the token-derived context. Because Chi does not enforce a schema on request parameters by default, the responsibility falls to the developer to ensure that JWT-derived values are treated as data and not as executable query structure.

The risk is compounded when the JWT Token is used not only for identity but also for dynamic query assembly across multiple data stores. A misconfigured public-key verification or relaxed leeway in token validation may allow an attacker to escalate privileges by changing roles or scopes in the token. Once combined with a NoSQL query that uses these values to filter or project fields, the application may inadvertently expose administrative endpoints or sensitive collections. Continuous verification of JWT Tokens and strict separation between identity claims and query logic are essential to mitigate these interactions.

Remediation focuses on strict validation of JWT Tokens, avoiding direct use of token claims in query construction, and parameterizing all data inputs. In Chi, you can enforce verification before any database interaction and ensure that query structures remain static while only data values change.

Example: Verified JWT usage with parameterized queries

Use a dedicated library such as cheshire for JSON handling and a JWT library that supports key verification. Define a handler that validates the token and extracts only the minimal required claims, then pass those as parameters to a parameterized query.

(ns myapp.handler
  (:require [cheshire.core :as json]
            [buddy.sign.jwt :as jwt]
            [next.jdbc :as jdbc]
            [ring.util.response :as resp]))

(def db-spec {:dbtype "mongodb" :dbname "mydb"})

(defn verify-token [token]
  (try
    (jwt/verify token <your-public-key> {:alg "RS256"})
    (catch Exception _
      nil)))

(defn handle-request [request]
  (let [auth-header (get-in request [:headers "authorization"])
        token (when auth-header (re-find #"Bearer\s(\S+)" auth-header))
        payload (when token (verify-token (second (re-find #"Bearer\s(\S+)" auth-header))))
        tenant-id (get payload "tenant_id")
        user-id (get payload "sub")]
    (if (and tenant-id user-id)
      (let [results (jdbc/execute! db-spec
                                   ["db.collection.find"
                                    {"tenant_id" tenant-id "user_id" user-id "status" "active"}
                                    {}])]
        (resp/json-response results))
      (resp/status-response 401 "Unauthorized"))))

Example: Avoiding injection by not merging user input into query maps

Never build query maps by concatenating or merging maps that may contain token-derived values in a way that alters structure. Instead, treat token claims as scalar values used only in equality checks.

(defn safe-query [db-spec tenant-id user-id]
  (jdbc/execute! db-spec
                 ["db.collection.find"
                  {"tenant_id" tenant-id
                   "user_id" user-id
                   "deleted" false}
                  {}]))

Additional practices

• Verify JWT Tokens on every request using strong algorithms and key rotation.
• Do not rely on client-supplied fields to construct query operators such as $where, $regex, or aggregation stages derived from token claims.
• Use parameterized statements or builder APIs that separate structure from data.
• Log verification failures and reject requests with malformed tokens immediately.