Privilege Escalation in Gorilla Mux with Jwt Tokens

Gorilla Mux is a widely used HTTP request router for Go that matches incoming requests against registered routes. When JWTs are used for authorization, misconfigurations in how claims and routes are evaluated can enable privilege escalation. A common pattern is to rely on a middleware that validates the token and injects the claims into the request context, but if route-specific authorization is not enforced per endpoint, a higher-privilege route can be accessed by reusing a token issued for a lower-privilege role.

Consider an API where an authenticated user receives a JWT containing role: user, and an admin route is defined under /admin/users. If the authorization check for that route is omitted or incorrectly applied, a user with the same JWT can send a GET request to /admin/users and receive a successful response. This occurs because Gorilla Mux matches the path first, and if the handler does not validate role claims before performing sensitive operations, the unauthenticated privilege check gap is effectively bypassed.

Another scenario involves claims-based authorization where scopes or roles are not validated on each handler. For example, a token issued for read-only access might still be accepted for write endpoints if the handler trusts the presence of the token rather than the specific claims required for the action. This is an instance of broken access control mapped to the OWASP API Top 10 category:2023 – Broken Object Level Authorization (BOLA), which often overlaps with privilege escalation when roles are not enforced consistently.

Additionally, route parameters can be manipulated to change the perceived identity or role if the handler constructs logic based on path variables without re-validating the JWT claims. An attacker might alter an id parameter in a URL like /users/{id}/promote and, if the handler promotes based solely on the parameter without confirming the requester’s role in the JWT, elevate their privileges unintentionally. This highlights the importance of correlating route matching in Gorilla Mux with runtime claim validation to prevent unauthorized access escalation.

To mitigate privilege escalation when using JWTs with Gorilla Mux, implement strict role-based access control in each handler and validate claims on every request. Below is a complete, syntactically correct example that demonstrates secure token validation, role extraction, and route-specific authorization.

package main

import (
	"context"
	"fmt"
	"log"
	"net/http"
	"strings"

	"github.com/dgrijalva/jwt-go"
	"github.com/gorilla/mux"
)

type Claims struct {
	Role string `json:"role"`
	jwt.StandardClaims
}

var jwtKey = []byte("my_secret_key")

func authMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		authHeader := r.Header.Get("Authorization")
		if authHeader == "" {
			http.Error(w, "Authorization header required", http.StatusUnauthorized)
			return
		}
		bearerToken := strings.Split(authHeader, " ")
		if len(bearerToken) != 2 {
			http.Error(w, "Invalid auth format", http.StatusUnauthorized)
			return
		}
		tokenStr := bearerToken[1]
		token, err := jwt.ParseWithClaims(tokenStr, &Claims{}, func(token *jwt.Token) (interface{}, error) {
			return jwtKey, nil
		})
		if err != nil || !token.Valid {
			http.Error(w, "Invalid token", http.StatusUnauthorized)
			return
		}
		if claims, ok := token.Claims.(*Claims); ok {
			ctx := context.WithValue(r.Context(), "claims", claims)
			r = r.WithContext(ctx)
			next.ServeHTTP(w, r)
		} else {
			http.Error(w, "Unable to parse claims", http.StatusUnauthorized)
		}
	})
}

func roleMiddleware(requiredRole string, next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		claims, ok := r.Context().Value("claims").(*Claims)
		if !ok || claims.Role != requiredRole {
			http.Error(w, "Insufficient permissions", http.StatusForbidden)
			return
		}
		next.ServeHTTP(w, r)
	})
}

func adminHandler(w http.ResponseWriter, r *http.Request) {
	w.Write([]byte("Admin access granted"))
}

func main() {
	r := mux.NewRouter()

	r.Handle("/public", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("Public endpoint"))
	})).Methods("GET")

	r.Handle("/admin/users", authMiddleware(roleMiddleware("admin", http.HandlerFunc(adminHandler)))).Methods("GET")

	server := &http.Server{
		Addr:    ":8080",
		Handler: r,
	}
	log.Println("Server starting on :8080")
	log.Fatal(server.ListenAndServe())
}

In this example, authMiddleware validates the JWT and attaches claims to the context. roleMiddleware enforces that only requests with role: admin can reach the handler. By chaining these middlewares per route in Gorilla Mux, privilege escalation across endpoints is prevented. For production, rotate jwtKey, prefer RS256 over HS256, and validate standard claims like exp and iss.

Furthermore, ensure that sensitive routes do not rely solely on path-based matching. Always re-validate the JWT on each request and check the extracted role against the required permission for the operation. This approach aligns with the principle of enforcing authorization close to the handler and reduces the risk of misconfiguration leading to privilege escalation.