Replay Attack in Grape with Bearer Tokens

A replay attack occurs when an attacker intercepts a valid request and retransmits it to reproduce the original effect. In Grape-based APIs that rely on Bearer Tokens, this risk arises because the token itself is often the only credential presented, and if the request lacks effective replay protection, the token can be reused maliciously. For example, an attacker who captures an HTTPS request containing Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... can replay that exact request to the same endpoint to perform actions or access resources as the original user.

Grape does not enforce replay protection by default. If your API endpoints accept Bearer Tokens via the Authorization header and do not implement additional safeguards, they are susceptible. Common missing controls include: a nonce or one-time-use token mechanism, strict timestamp validation, or idempotency keys. Without these, an attacker can capture a token (e.g., via network sniffing or compromised client storage) and replay the request within the token’s validity window. This is especially dangerous for operations that change state—such as transferring funds or updating user settings—because the server treats the replayed request as legitimate.

Consider an endpoint that transfers money using a Bearer Token. A captured POST request with a JSON body like {"to": "attacker_account", "amount": 500} can be resent multiple times. Since the token is valid and no nonce or timestamp check exists, the server processes each replay, leading to unauthorized transfers. Even if TLS is used, termination points or compromised clients can expose tokens, making replay feasible. MiddleBrick’s scans include checks for missing replay defenses and can surface such patterns when analyzing your Grape API’s unauthenticated attack surface.

Real-world attack patterns mirror this: stolen tokens from logs, client-side storage, or accidental exposure in referrers can enable replay. The OWASP API Security Top 10 highlights broken object level authorization and security misconfiguration as common roots, and replay fits into these categories when uniqueness constraints (like nonces) are absent. Using tools that inspect OpenAPI specs and runtime behavior—such as comparing definitions for idempotency requirements against actual endpoint behavior—helps detect whether replay protections are inconsistently applied across versions.

To validate exposure, security testing can send the same request with identical headers and body to the same URL and observe whether the server accepts it as a new transaction. MiddleBrick’s LLM/AI Security checks do not test replay directly, but its inventory and authentication checks can highlight endpoints where Bearer Token usage is present without complementary safeguards. Continuous monitoring helps ensure that new endpoints do not reintroduce the risk. Overall, recognizing that Bearer Tokens alone are insufficient for replay prevention is key; combining them with uniqueness and freshness checks is necessary to reduce the attack surface.

Remediation focuses on ensuring each request is unique and time-bound. Implement server-side nonce tracking and timestamp validation within your Grape API. Below are concrete code examples for a Grape endpoint that validates a Bearer Token while checking replay risk.

# Gemfile
gem 'grape'
gem 'redis', require: 'redis'

# app/api/base_api.rb
require 'grape'
require 'securerandom'
require 'redis'

class BaseApi < Grape::API
  format :json
  helpers do
    def current_user
      # Extract Bearer token
      auth_header = request.env['HTTP_AUTHORIZATION']
      token = auth_header&split(' ')&last if auth_header&start_with?('Bearer ')
      return nil unless token

      # Verify token via your user store or JWT library
      # This is a placeholder for actual validation logic
      @current_user ||= User.find_by(access_token: token)
    end

    def validate_replay(identifier, ttl = 300)
      redis = Redis.new(url: ENV['REDIS_URL'])
      key = "replay_protection:#{identifier}"
      # Use SET with NX and EX to atomically set if not exists and set TTL
      added = redis.set(key, '1', nx: true, ex: ttl)
      added == true # returns true if new, false if already exists (replay)
    rescue Redis::CannotConnectError
      # In production, handle gracefully (e.g., log and allow or deny based on policy)
      false
    end
  end

  before do
    token = request.env['HTTP_AUTHORIZATION']&split(' ')&last
    halt 401, { error: 'Unauthorized' } unless token

    # Build a replay-safe identifier: method + path + body + timestamp window
    timestamp = Time.now.utc.to_i
    window = (timestamp / 300).to_i # 5-minute window
    identifier = "#{request.request_method}:#{request.fullpath}:#{body}:#{window}"

    halt 403, { error: 'Replay detected' } unless validate_replay(identifier, 300)
  end

  resource :transfer do
    desc 'Transfer funds' do
      failure [ [401, 'Unauthorized'], [403, 'Replay detected'] ]
    end
    params do
      requires :to, type: String, desc: 'Recipient account'
      requires :amount, type: Integer, desc: 'Amount in cents'
      requires :timestamp, type: Integer, desc: 'Client UTC timestamp for freshness check'
    end
    post do'
      # Optional additional freshness check beyond replay window
      client_ts = params[:timestamp].to_i
      server_ts = Time.now.utc.to_i
      halt 403, { error: 'Request too old' } if (server_ts - client_ts).abs > 60

      # Business logic here
      { status: 'ok', message: 'Transfer initiated' }
    end
  end
end

The example uses a Redis-backed nonce with a time window to ensure that identical requests within the window are rejected. The identifier combines HTTP method, path, request body, and a coarse time window to reduce storage while preventing reuse. For Bearer Token validation, replace the placeholder with your actual token verification (e.g., JWT decoding or database lookup). Ensure Redis connectivity and error handling align with your production resilience requirements.

Additionally, encourage clients to include a client-generated timestamp and use short token lifetimes to shrink the replay window. If you use Grape with Rails, integrate with your existing session and cache store instead of Redis when appropriate. MiddleBrick’s dashboard can track whether endpoints include freshness parameters and nonces by inspecting request definitions and flagging those missing replay-related parameters.

For CI/CD integration, use the middlebrick CLI to scan your API after changes: middlebrick scan https://api.example.com. The GitHub Action can enforce a minimum score threshold, failing builds if replay-related findings appear. The MCP Server lets you run scans from your IDE while developing, providing immediate feedback. These products help maintain consistent protections across versions without manually auditing each endpoint.