Pii Leakage in Gorilla Mux with Dynamodb

Gorilla Mux is a widely used HTTP request router for Go that supports route variables, matchers, and named routes. When combined with DynamoDB as a backend data store, PII leakage can occur if application code inadvertently exposes sensitive attributes in responses, logs, or error messages. The risk typically arises from how route parameters are mapped to DynamoDB key expressions and how query results are serialized back to the client.

Consider a user profile endpoint defined with Gorilla Mux that uses a route variable such as {userID}. The handler constructs a DynamoDB key using the variable directly, for example:

vars := mux.Vars(request)
userID := vars["userID"]
key := map[string]*dynamodb.AttributeValue{
    "user_id": {S: aws.String(userID)},
}

If the handler then performs a GetItem and returns the full DynamoDB attribute map to the client without filtering, fields such as email, phone_number, or ssn may be included in the JSON response. These fields constitute PII when exposed to unauthenticated or unauthorized consumers. The exposure is not inherent to Gorilla Mux or DynamoDB individually, but emerges from insecure handling patterns: missing access controls, overly broad attribute selection, or insufficient output validation.

Another vector involves DynamoDB queries that return multiple items. For instance, a handler might query a secondary index to retrieve records associated with an organization:

input := &dynamodb.QueryInput{
    TableName:              aws.String("users"),
    IndexName:              aws.String("org_email_index"),
    KeyConditionExpression: aws.String("org_id = :org_id"),
    ExpressionAttributeValues: map[string]*dynamodb.AttributeValue{
        ":org_id": {S: aws.String(orgID)},
    },
}
result, err := svc.Query(context.TODO(), input)

If the application iterates over result.Items and serializes each map directly to JSON, any PII fields present in those items are transmitted. Additionally, logging the raw DynamoDB response at DEBUG level can leak PII to log aggregation systems. The combination of Gorilla Mux’s flexible routing and DynamoDB’s schema-less attribute storage increases the surface area for accidental data exposure when developers do not explicitly limit which attributes are returned or stored.

LLM/AI Security checks available in middleBrick can detect system prompt leakage patterns and output scanning for PII in textual responses. While these are tailored for AI endpoints, the underlying principle of inspecting uncontrolled output applies: any endpoint that returns data derived from DynamoDB should validate that sensitive fields are excluded based on the caller’s authorization context.

Remediation focuses on strict attribute selection, proper access controls, and defensive serialization. Instead of returning the full DynamoDB item, construct a minimal response structure that includes only non-sensitive fields.

First, define a dedicated response struct:

type UserProfile struct {
    UserID   string `json:"user_id"`
    Username string `json:"username"`
    Email    string `json:"email"`
}

Then, map the DynamoDB item to this struct, ensuring PII fields are omitted or encrypted as needed:

var item map[string]*dynamodb.AttributeValue	err := resp.GetItem(&dynamodb.GetItemInput{
    TableName:              aws.String("users"),
    Key:                    key,
    ProjectionExpression:   aws.String("user_id, username, email"),
})
if err != nil {
    http.Error(w, "unable to read item", http.StatusInternalServerError)
    return
}

profile := UserProfile{}
if av, ok := item["user_id"]; ok {
    profile.UserID = *av.S
}
if av, ok := item["username"]; ok {
    profile.Username = *av.S
}
if av, ok := item["email"]; ok {
    profile.Email = *av.S
}

w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(profile)

For queries, apply the same principle by projecting only required attributes and filtering items based on authorization:

input := &dynamodb.QueryInput{
    TableName:              aws.String("users"),
    IndexName:              aws.String("org_email_index"),
    KeyConditionExpression: aws.String("org_id = :org_id"),
    FilterExpression:       aws.String("attribute_exists(email)"),
    ExpressionAttributeValues: map[string]*dynamodb.AttributeValue{
        ":org_id": {S: aws.String(orgID)},
    },
    ProjectionExpression:   aws.String("user_id, username, email"),
}
result, err := svc.Query(context.TODO(), input)
if err != nil {
    http.Error(w, "query failed", http.StatusInternalServerError)
    return
}

var profiles []UserProfile
for _, item := range result.Items {
    var p UserProfile
    if av, ok := item["user_id"]; ok {
        p.UserID = *av.S
    }
    if av, ok := item["username"]; ok {
        p.Username = *av.S
    }
    if av, ok := item["email"]; ok {
        p.Email = *av.S
    }
    profiles = append(profiles, p)
}

w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(profiles)

Additionally, enforce authorization checks before querying or retrieving items. Use the Gorilla Mux context to pass request-scopes such as roles or scopes and validate that the authenticated subject is permitted to access the target resource. Avoid logging raw items; if logging is required, sanitize PII fields explicitly.