Password Spraying in Chi with Mutual Tls

Password spraying is an authentication-bypass technique where an attacker uses a small set of common passwords against many accounts. In environments using Mutual TLS (mTLS) for client authentication, password spraying can still be relevant when the API or service has both mTLS and password-based login paths, or when mTLS is used only for certain endpoints while others rely on traditional credentials. In Chi, a server-side web framework for the Erlang VM (BEAM), this combination can expose weaknesses if TLS client certificate verification is not enforced consistently or if fallback authentication mechanisms are misconfigured.

When mTLS is implemented but optional, or when route-level security is unevenly applied, attackers can probe endpoints that do not require client certificates and attempt password spraying. Even when mTLS is required, supplementary password checks (e.g., internal admin portals or legacy integrations) may present an additional attack surface. Chi applications that parse client certificates but still accept username/password credentials without sufficient rate limiting or anomaly detection can be vulnerable to credential enumeration and account compromise. The framework itself does not introduce the vulnerability, but routing and security decisions in Chi can inadvertently allow password spraying against endpoints that should rely solely on mTLS.

For example, consider a Chi router that conditionally requires TLS based on route or connection metadata. If some routes do not enforce client certificate validation, an attacker can target those routes with password spraying. Even when mTLS is enforced, if the service accepts credentials after TLS authentication (e.g., to support multi-factor patterns), weak passwords become a risk. The scanning methodology used by tools such as middleBrick, which includes authentication checks and input validation, can help detect inconsistent mTLS enforcement and weak credential practices in Chi-based APIs.

To mitigate password spraying risks in Chi when using Mutual TLS, enforce strict client certificate validation on all sensitive routes and avoid mixing authentication factors inconsistently. Below are concrete Chi code examples that demonstrate how to require and verify mTLS, and how to structure routes to minimize the attack surface.

{deps, []} = :ssl.start([:certify]),

opts = [
  certfile: "/path/to/server-cert.pem",
  keyfile: "/path/to/server-key.pem",
  cacertfile: "/path/to/ca.pem",
  verify: :verify_peer,
  fail_if_no_peer_cert: true
],

{:ok, _} = :ssl.listen(8443, opts)

In a Chi router, you can enforce mTLS by inspecting the peer certificate and rejecting requests that do not present a valid client certificate:

defmodule MyApp.Router do
  use Tesla

  plug fn env, next ->
    case env[:ssl][:peer_cert] do
      nil ->
        {:error, :missing_client_cert}

      cert ->
        case verify_client_cert(cert) do
          :ok -> next.(env)
          :error -> {:error, :invalid_client_cert}
        end
    end
  end

  get "/api/secure", fn req, res ->
    # Only reached if mTLS verification passed
    MyApp.Controllers.secure_call(req, res)
  end

  defp verify_client_cert(cert) do
    # Validate against trusted CA and revocation as needed
    case :public_key.pkix_path_validation(cert, trusted_certs()) do
      {:ok, _} -> :ok
      _ -> :error
    end
  end

  defp trusted_certs do
    # Load trusted CA certificates
    # In practice, load from config or a trusted path
    ["/path/to/ca.pem"]
  end
end

Additionally, avoid adding password-based fallbacks on routes that already rely on mTLS. If credentials must be supported (e.g., for backward compatibility), enforce strict rate limiting and monitor for spraying patterns. The following example shows a Chi route that rejects password authentication when a valid client certificate is already present:

defmodule MyApp.Router do
  plug :require_mtls_or_reject_password

  defp require_mtls_or_reject_password(env, _opts) do
    if has_valid_peer_cert?(env) do
      {:ok, env}
    else
      # Allow password flow only when mTLS is not used
      # Apply additional controls such as rate limiting
      maybe_allow_password_flow(env)
    end
  end

  defp has_valid_peer_cert?(env) do
    case env[:ssl][:peer_cert] do
      nil -> false
      cert -> verify_client_cert(cert) == :ok
    end
  end
end

Ensure that all routes handling sensitive operations require mTLS and that the application fails closed if certificate validation cannot be completed. Use Chi’s plug pipeline to centralize these checks and keep authentication logic explicit and testable. These measures reduce the viability of password spraying by narrowing the paths where password-based authentication is allowed and by ensuring mTLS is consistently enforced.