Ssrf Server Side in Gin with Bearer Tokens

Server-side request forgery (SSRF) in a Gin-based API becomes more risky when Bearer tokens are used for authorization. Bearer tokens are typically passed in the Authorization header (e.g., Authorization: Bearer ), and a vulnerable Gin endpoint that accepts a URL from an attacker can forward requests while automatically including that header. This means the backend can act on behalf of the token holder, potentially reaching internal services that are not exposed publicly.

For example, if your Gin application retrieves an internal dashboard URL from user input and makes an outbound HTTP request with the same Bearer token, an attacker can supply a target like http://169.254.169.254/latest/meta-data/ to reach the cloud metadata service. Because the request carries the token, the backend may expose sensitive identity or configuration data. Common triggers include dynamic URL construction, use of a shared HTTP client, and missing allowlists for destination hosts and schemes.

In an OpenAPI spec for Gin, such issues often appear where a parameter is used to build a request without host validation. Consider an endpoint defined with a URL parameter:

paths:
  /forward:
    get:
      summary: Forward request to a target URL
      parameters:
        - name: target
          in: query
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK

If the backend implementation blindly uses the target query parameter to create a new request and attaches the Authorization header, the unauthenticated attack surface includes metadata and internal endpoints. MiddleBrick’s LLM/AI Security checks include system prompt leakage patterns and active prompt injection probes, but for API security it’s essential to validate that outbound calls do not inadvertently propagate credentials to untrusted destinations.

Real-world attack patterns mirror this: an SSRF chain can lead to metadata exposure (CVE scenarios involving cloud metadata), internal service enumeration, or SSRF-to-RCE when combined with other weaknesses. In Gin, developers should treat any user-supplied URL as hostile and avoid automatically forwarding Authorization headers unless explicitly required and tightly scoped.

To mitigate SSRR when Bearer tokens are involved, restrict outbound destinations and avoid propagating credentials automatically. Use an allowlist of trusted hosts and schemes, and do not forward Authorization headers to user-defined targets. Below are concrete, syntactically correct examples for Gin.

1) Safe handler with explicit destination allowlist and no automatic Bearer propagation:

package main

import (
    "net/http"
    "strings"

    "github.com/gin-gonic/gin"
)

func main() {
    r := gin.Default()
    r.GET("/fetch", func(c *gin.Context) {
        target := c.Query("url")
        if !isAllowedTarget(target) {
            c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "destination not allowed"})
            return
        }
        req, err := http.NewRequestWithContext(c.Request.Context(), "GET", target, nil)
        if err != nil {
            c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "invalid url"})
            return
        }
        // Explicitly do NOT copy Authorization header to avoid leaking token to arbitrary hosts
        resp, err := http.DefaultClient.Do(req)
        if err != nil {
            c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "request failed"})
            return
        }
        defer resp.Body.Close()
        c.Status(resp.StatusCode)
    })
    r.Run()
}

func isAllowedTarget(raw string) bool {
    // Basic validation; in production use a strict allowlist and URL parsing
    if !strings.HasPrefix(raw, "https://api.trusted.example.com/") {
        return false
    }
    // Reject dangerous schemes
    if strings.HasPrefix(raw, "http://") {
        return false
    }
    return true
}

2) If you must conditionally forward credentials, scope the token usage to a specific, vetted backend and do not rely on user input for host selection:

func trustedProxy(c *gin.Context) {
    const upstream = "https://internal-service.example.com/metrics"
    // Optionally derive a token from server-side config, not user input
    token := "server-side-token"
    req, _ := http.NewRequest("GET", upstream, nil)
    req.Header.Set("Authorization", "Bearer "+token)
    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusBadGateway, gin.H{"error": "upstream error"})
        return
    }
    defer resp.Body.Close()
    c.Status(resp.StatusCode)
}

3) Use environment variables or configuration for tokens instead of accepting tokens from clients. This prevents token amplification via user-controlled URLs and aligns with least-privilege principles.

These patterns reduce the risk that an SSRF vulnerability leads to token leakage or unauthorized access to internal resources. Always complement code-level fixes with runtime scanning; MiddleBrick’s CLI can be used as follows to detect such issues:

middlebrick scan https://your-api.example.com

For continuous assurance, the Pro plan includes continuous monitoring and can be integrated into CI/CD via the GitHub Action to fail builds if risk scores degrade.