Replay Attack in Fiber with Dynamodb

A replay attack in the context of a Fiber application that uses Dynamodb as a persistence layer occurs when an attacker intercepts a valid request and re-sends it to the API to reproduce an effect such as a duplicate transaction, unauthorized state change, or privilege escalation. This risk arises from a combination of application-level handling of requests and how Dynamodb operations are issued and validated.

In a typical Fiber API, an HTTP endpoint might accept a JSON payload that includes an identifier, a timestamp, and a signature intended to prevent misuse. If the server-side logic does not enforce strict idempotency checks or time-bound validity, an attacker who captures this payload can replay it against the same endpoint. Because the application relies on Dynamodb to store and retrieve resource states (for example, recording a payment or updating a user’s balance), the replayed request may result in a second write operation that the server accepts as legitimate.

The interaction with Dynamodb becomes critical when conditional writes or uniqueness constraints are not enforced. For example, consider an endpoint that creates a payment record using a client-supplied idempotency key stored in Dynamodb. If the server performs a read to check for an existing key and then proceeds to write without an atomic conditional check, a race condition exists. An attacker could replay the request after the initial write has succeeded but before the server’s in-memory state reflects it, leading to a duplicate write under the same key.

Additionally, replay attacks can exploit predictable identifiers or timestamps. If the request includes a timestamp used to gate freshness but the server does not validate this strictly against Dynamodb-stored metadata, an attacker might reuse a recent, valid request within the allowed window. This is especially relevant when the API does not require authentication for the endpoint, because middleBrick’s scans highlight unauthenticated attack surfaces where such replay risks are more likely to be discovered.

Real-world attack patterns such as those seen in OWASP API Top 10 (e.g., broken object level authorization and lack of idempotency controls) map closely to these scenarios. A replay attack does not require breaking encryption or SSRF; it relies on logical gaps in how requests are de-duplicated and how Dynamodb operations are guarded. middleBrick scans can surface these findings, noting missing idempotency safeguards, weak timestamp validation, and unauthenticated endpoints that increase exposure.

To mitigate replay attacks in a Fiber application using Dynamodb, implement idempotency at the data layer by using conditional writes and unique keys, and enforce strict request validation including timestamps and cryptographic signatures.

First, design your Dynamodb table to support idempotency by using a composite primary key that includes an idempotency token provided by the client. Use a conditional write to ensure that a token is written only once. The following example shows how to perform a conditional put in Go using the AWS SDK for DynamoDB, integrated with a Fiber handler.

// Define a structure for the request body
type PaymentRequest struct {
    IDempotencyKey string  `json:"idempotencyKey"`
    UserID         string  `json:"userId"`
    Amount         float64 `json:"amount"`
    Timestamp      int64   `json:"timestamp"`
    Signature      string  `json:"signature"`
}

// Handler in Fiber
app.Post("/payments", func(c *fiber.Ctx) error {
    var req PaymentRequest
    if err := c.BodyParser(&req); err != nil {
        return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request"})
    }

    // Basic freshness check to mitigate replay windows
    now := time.Now().Unix()
    if math.Abs(float64(req.Timestamp-now)) > 30 {
        return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "request expired"})
    }

    // Verify signature (implementation omitted for brevity)
    if !verifySignature(req) {
        return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "invalid signature"})
    }

    // Prepare DynamoDB input with a conditional check
    input := &dynamodb.PutItemInput{
        TableName: aws.String("Payments"),
        Item: map[string]types.AttributeValue{
            "IdempotencyKey": &types.AttributeValueMemberS{Value: req.IDempotencyKey},
            "UserID":         &types.AttributeValueMemberS{Value: req.UserID},
            "Amount":         &types.AttributeValueMemberN{Value: strconv.FormatFloat(req.Amount, 'f', -1, 64)},
            "Timestamp":      &types.AttributeValueMemberN{Value: strconv.FormatInt(req.Timestamp, 10)},
        },
        ConditionExpression: aws.String("attribute_not_exists(IdempotencyKey)"),
    }

    _, err := dynamoClient.PutItem(c.Context(), input)
    if err != nil {
        var awsErr awserr.Error
        if errors.As(err, &awsErr) && awsErr.Code() == dynamodb.ErrCodeConditionalCheckFailedException {
            // Idempotency key already used — safe to respond with the original result or an error
            return c.Status(fiber.StatusConflict).JSON(fiber.Map{"error": "duplicate request detected"})
        }
        return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "server error"})
    }

    return c.SendStatus(fiber.StatusCreated)
}

Second, enforce server-side timestamp validation and replay-window tracking. Store recent idempotency keys in a short-lived in-memory cache or a separate Dynamodb TTL table to reject requests with keys seen within a defined time window. This complements the conditional write and reduces pressure on the main table.

Third, require strong authentication and integrity checks for endpoints that mutate state. Even if an endpoint is public, require a signature derived from a shared secret and include the timestamp in the signed payload. Verify both the signature and freshness before proceeding to Dynamodb operations. This approach aligns with common findings reported by middleBrick, where missing authentication and weak freshness controls are highlighted.

Finally, use middleBrick’s scans to verify that your endpoints correctly implement these controls. The tool can identify unauthenticated attack surfaces and missing idempotency safeguards, helping you refine the remediation strategy in a Fiber application backed by Dynamodb.