Padding Oracle in Gin with Bearer Tokens

A padding oracle in a Gin service typically arises when encrypted data (for example, a JWT or a custom ciphertext carried in an HTTP header) is decrypted with an error that leaks whether a padding byte is valid. If the server distinguishes between a padding error and other validation failures (such as signature mismatch or invalid claims), an attacker can iteratively submit modified ciphertexts and observe differences in responses or timing to recover plaintext or forge tokens.

Bearer tokens are often transmitted via the Authorization header (Authorization: Bearer <token>). When those tokens are encrypted or signed using block encryption in an ad-hoc way, and the Gin backend does not use constant-time comparison and consistent error handling, the combination becomes vulnerable. For example, an attacker who can intercept or guess a token can send modified ciphertexts to the Gin endpoint and use the server’s behavior (HTTP 401 vs 400, different response body content, or timing differences) as an oracle to gradually decrypt or forge the token without knowing the key.

Consider a scenario where a Gin handler manually decrypts a Bearer token using AES-CBC and validates a payload after removing PKCS#7 padding. If the decryption call returns a distinct error for invalid padding versus invalid integrity, and the HTTP handler returns different status codes or messages for each case, the endpoint acts as a padding oracle:

• An attacker submits modified ciphertext blocks and observes whether the server responds with a padding error or a later validation error (e.g., invalid signature).
• By repeating this process block by block, guided by the oracle’s responses, the attacker can recover the plaintext or craft valid ciphertexts.

Even when tokens are cryptographically signed (e.g., JWT with HMAC), a padding oracle can appear in a non-token context: if the Gin app decrypts a Bearer token that is actually an encrypted blob, or if custom middleware mixes decryption and signature verification in a way that timing or error messages differ based on padding validity. Using static, public keys and standard JWT parsing helps avoid this, but ad-hoc decryption of Bearer values remains risky.

To detect this during a scan, middleBrick checks whether error messages differ for padding failures versus other validation failures, and whether unauthenticated endpoints that process Bearer tokens exhibit timing variability. Findings include references to OWASP API Top 10 categories such as Cryptographic Failures and Security Misconfiguration, aligned with relevant controls in frameworks like PCI-DSS and SOC2.

Remediation focuses on using standard, well-audited libraries for token handling, ensuring constant-time operations, and returning uniform error responses for all authentication failures. Avoid manual padding removal or custom decryption logic for Bearer tokens; prefer JWT libraries that handle verification in a single, constant-time step.

Below is an example of safe Bearer token validation in Gin using the golang-jwt/jwt package. This approach avoids padding oracle risks by relying on the library’s verified implementation and by ensuring the error path does not leak which step failed (padding, signature, or claims):

package main

import (
	"github.com/gin-gonic/gin"
	"github.com/golang-jwt/jwt/v5"
	"net/http"
)

var jwtKey = []byte("your-32-byte-secret-key-here-32byteslong")

func authMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		authHeader := c.GetHeader("Authorization")
		if authHeader == "" {
			authFailed(c, "missing authorization header")
			return
		}

		const bearerPrefix = "Bearer "
		if len(authHeader) < len(bearerPrefix) || authHeader[:len(bearerPrefix)] != bearerPrefix {
			authFailed(c, "invalid authorization header format")
			return
		}

		tokenString := authHeader[len(bearerPrefix):]
		token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
			// Ensure the signing method is what you expect
			if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
				return nil, jwt.ErrSignatureInvalid
			}
			return jwtKey, nil
		})

		if err != nil || !token.Valid {
			authFailed(c, "invalid token")
			return
		}

		c.Next()
	}
}

func authFailed(c *gin.Context, message string) {
	c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "unauthorized", "message": message})
}

func main() {
	r := gin.Default()
	r.Use(authMiddleware())
	r.GET("/protected", func(c *gin.Context) {
		c.JSON(http.StatusOK, gin.H{"status": "ok"})
	})
	r.Run(":8080")
}

If you store encrypted Bearer values that you must decrypt, use an authenticated encryption mode such as AES-GCM and ensure you do not reveal padding errors. For example, decrypt and then verify integrity in a single step, and return a generic error on failure:

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"errors"
	"io"
)

func decryptToken(data, key []byte) ([]byte, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, errors.New("decryption error")
	}
	if len(data) < aes.BlockSize {
		return nil, errors.New("decryption error")
	}
	iv := data[:aes.BlockSize]
	ciphertext := data[aes.BlockSize:]
	if len(ciphertext)%aes.BlockSize != 0 {
		return nil, errors.New("decryption error")
	}
	mode cipher.BlockMode = cipher.NewCBCDecrypter(block, iv)
	plaintext := make([]byte, len(ciphertext))
	mode.CryptBlocks(plaintext, ciphertext)
	// Use a canonical padding removal that does not branch on padding value
	plaintext, err = pkcs7UnpadConstantTime(plaintext, aes.BlockSize)
	if err != nil {
		return nil, errors.New("decryption error")
	}
	return plaintext, nil
}

// Constant-time unpadding to avoid padding oracle
func pkcs7UnpadConstantTime(data []byte, blockSize int) ([]byte, error) {
	if len(data) == 0 || len(data)%blockSize != 0 {
		return nil, errors.New("invalid length")
	}
	// Read last byte without data-dependent branches on its value
	last := data[len(data)-1]
	if last == 0 || int(last) > blockSize {
		return nil, errors.New("invalid padding")
	}
	// Verify all padding bytes in constant time by accumulating a mask
	var mask byte
	for i := len(data) - int(last); i < len(data); i++ {
		mask |= data[i] ^ last
	}
	if mask != 0 {
		return nil, errors.New("invalid padding")
	}
	return data[:len(data)-int(last)], nil
}

Key remediation practices:

• Use standardized token formats (JWT) and verified libraries instead of custom encryption/decryption for Bearer tokens.
• Ensure error messages are uniform and do not distinguish between padding errors, signature failures, or invalid claims.
• Apply constant-time operations for any cryptographic comparison or unpadding.
• Validate tokens at the edge (e.g., in middleware) and avoid branching logic that reveals which check failed.

middleBrick can help identify padding oracle risks by comparing error responses and timing behavior across unauthenticated endpoints that process Bearer tokens. Findings map to relevant compliance frameworks and include prioritized remediation guidance.