Ssrf Server Side in Chi with Basic Auth

Server-side request forgery (SSRF) in Chi when Basic Authentication is used can amplify request smuggling and internal reconnaissance. Chi is an HTTP library for Go, and when it constructs requests with hard‑coded or user-supplied URLs, an attacker may supply a target that points to internal services (e.g., http://127.0.0.1:8080/health or metadata endpoints). If the request includes Basic Auth credentials via header or via URL userinfo (user:password@host), those credentials may be forwarded to internal endpoints that otherwise would not be reachable, effectively bypassing network segregation.

Basic Auth credentials are often reused across services. When a vulnerable Chi handler blindly follows redirects or proxies requests based on attacker input, the credentials can be delivered to internal endpoints that log or reflect them, aiding lateral movement. In SSRF chains, attackers may leverage Chi’s outbound HTTP client to probe internal metadata services (for example, http://169.254.169.254/latest/meta-data/ on cloud environments) while carrying stolen or embedded credentials. This exposes sensitive metadata and can lead to further compromise, especially when the service identity attached to the Basic Auth secret has elevated permissions.

The interaction between SSRF and Basic Auth becomes critical when Chi is used in server-side integrations that accept URLs from users, such as webhooks or URL-based fetching features. Without strict allowlisting and careful transport configuration, the client may follow redirects to internal IPs, ignore certificate validation, or fail to strip credentials before forwarding. This exposes internal attack surfaces and can turn a simple SSRF into a credential‑theft or internal service enumeration path.

To mitigate SSRF when using Basic Auth in Chi, avoid embedding credentials in the request URL and instead inject them via headers only for trusted destinations. Use a custom transport that conditionally adds Authorization headers and ensure that redirects and proxy targets are validated against an allowlist. The following examples demonstrate secure patterns.

Example 1: Injecting Basic Auth via header only, with strict host allowlist

import (
    "net/http"
    "strings"
)

// allowedHosts is an allowlist of trusted host:port values.
var allowedHosts = map[string]bool{
    "api.example.com:443": true,
    "internal.service:8080": true,
}

func isAllowed(u *url.URL) bool {
    return allowedHosts[u.Host]
}

func secureClient() *http.Client {
    return &http.Client{
        Transport: &http.Transport{
            // Configure TLS and other transport options here if needed.
        },
    }
}

func makeRequest(targetURL string, user, pass string) (*http.Response, error) {
    u, err := url.Parse(targetURL)
    if err != nil {
        return nil, err
    }
    if !isAllowed(u) {
        return nil, http.ErrNotSupported
    }

    req, err := http.NewRequest("GET", u.String(), nil)
    if err != nil {
        return nil, err
    }

    // Set Basic Auth via header; do NOT include credentials in URL.
    req.SetBasicAuth(user, pass)

    // Optionally strip userinfo from the final request to avoid accidental leaks.
    if u.User != nil {
        u.User = nil
    }

    client := secureClient()
    return client.Do(req)
}

Example 2: Redirect-safe client that removes Authorization for non‑trusted locations

func redirectPolicyFunc(req *http.Request, via []*http.Request) error {
    // Do not follow redirects to hosts not in allowlist.
    if !isAllowed(req.URL) {
        return http.ErrUseLastResponse
    }
    // Ensure Authorization header is only present for allowed hosts.
    if !strings.Contains(req.URL.Host, "trusted") {
        req.Header.Del("Authorization")
    }
    return nil
}

func buildClientWithRedirectControl() *http.Client {
    return &http.Client{
        CheckRedirect: redirectPolicyFunc,
    }
}

Operational practices

• Never embed userinfo in the request target (user:password@host); parse and remove it before sending.
• Use environment variables or a secrets manager to supply the username and password, not hard‑coded literals.
• Combine allowlisting with outbound firewall rules and network segmentation to reduce the impact of any residual SSRF.
• Regularly scan your API surface with middleBrick to detect SSRF and authentication misconfigurations; the CLI supports automated checks via middlebrick scan <url>, and the GitHub Action can enforce a minimum security score before merges.