Webhook Abuse in Fiber with Api Keys

Webhook abuse in Fiber when relying solely on API keys occurs when an attacker can cause your Fiber application to make unauthorized or excessive HTTP requests to third-party endpoints using a trusted API key. This typically arises from insufficient validation of webhook payloads, lack of origin verification, and missing constraints on user-controlled URL inputs that specify the target webhook destination.

In Fiber, API keys are often used to authenticate outbound calls—for example, when your route code forwards data to a payment provider or a SaaS API using an Authorization header like Bearer {key}. If an attacker can control the URL or parameters that determine which external service is called, they can force your server to relay requests and consume the privileged API key’s quota or permissions. Common patterns include user-supplied webhook URLs, dynamic callback endpoints, or query parameters that set the next-hop URL without strict allowlisting.

Consider a scenario where a POST route accepts a webhookUrl field and forwards events using an API key stored server-side:

package main

import (
	"fmt"
	"net/http"

	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/logger"
)

func main() {
	app := fiber.New()
	app.Use(logger.New())

	app.Post("/notify", func(c *fiber.Ctx) error {
		var payload map[string]interface{}
		if err := c.BodyParser(&payload); err != nil {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid body"})
		}
		webhookURL, ok := payload["webhookUrl"].(string)
		if !ok || webhookURL == "" {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "missing webhookUrl"})
		}
		apiKey := c.Get("X-API-Key") // key expected from caller (vulnerable if caller is untrusted)
		if apiKey == "" {
			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "missing api key"})
		}

		// Forward request to user-supplied URL using the API key
		req, _ := http.NewRequest("POST", webhookURL, nil)
		req.Header.Set("Authorization", "Bearer "+apiKey)
		client := &http.Client{}
		resp, err := client.Do(req)
		if err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "forwarding failed"})
		}
		defer resp.Body.Close()
		return c.SendStatus(resp.StatusCode)
	})

	app.Listen(":3000")
}

Here, the API key is supplied by the caller via X-API-Key. If the caller is untrusted (e.g., an unauthenticated attacker), they can provide any URL and cause your server to make requests using the key. This can lead to quota exhaustion, unintended actions on third-party services, or data exfiltration if the key has elevated scopes. Additionally, if the key is logged by the destination service, it may be exposed in logs or inferred via SSRF interactions with internal metadata services.

Webhook abuse therefore combines three elements: (1) a mechanism to specify arbitrary outbound targets, (2) the use of a privileged API key in requests, and (3) insufficient validation or authorization checks on the caller’s ability to influence that target. Without allowlists, signature verification, or scoping of the API key, this combination creates a vector for abuse.

To remediate webhook abuse when using API keys in Fiber, remove the ability for callers to influence the destination URL or strictly control it, and avoid exposing API keys to client influence. Instead, keep the key server-side and validate all inputs that affect outbound requests.

1) Use a hardcoded or configuration-managed API key and a strict allowlist of webhook targets

package main

import (
	"fmt"
	"net/http"

	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/logger"
)

var allowedWebhooks = map[string]bool{
	"https://partner-a.example.com/callback": true,
	"https://partner-b.example.com/event":  true,
}

var serverAPIKey = "sk_live_abcdef123456" // stored securely, not from caller

func main() {
	app := fiber.New()
	app.Use(logger.New())

	app.Post("/notify", func(c *fiber.Ctx) error {
		var payload map[string]interface{}
		if err := c.BodyParser(&payload); err != nil {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid body"})
		}
		webhookURL, ok := payload["webhookUrl"].(string)
		if !ok || webhookURL == "" {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "missing webhookUrl"})
		}
		if !allowedWebhooks[webhookURL] {
			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "webhook destination not allowed"})
		}

		req, _ := http.NewRequest("POST", webhookURL, nil)
		req.Header.Set("Authorization", "Bearer "+serverAPIKey)
		client := &http.Client{}
		resp, err := client.Do(req)
		if err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "forwarding failed"})
		}
		defer resp.Body.Close()
		return c.SendStatus(resp.StatusCode)
	})

	app.Listen(":3000")
}

This approach ensures the caller cannot specify arbitrary URLs and the API key never leaves the server environment.

2) If dynamic webhook configuration is required, use signed tokens or HMAC verification instead of raw API keys

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"net/http"

	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/logger"
)

var webhookSecret = []byte("super-secret-key") // stored securely
var serverAPIKey = "sk_live_abcdef123456"

func isValidSignature(payload []byte, signature string) bool {
	mac := hmac.New(sha256.New, webhookSecret)
	mac.Write(payload)
	expected := hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(expected), []byte(signature))
}

func main() {
	app := fiber.New()
	app.Use(logger.New())

	app.Post("/dynamic-webhook", func(c *fiber.Ctx) error {
		var payloadMap map[string]interface{}
		if err := c.BodyParser(&payloadMap); err != nil {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid body"})
		}
		signature := c.Get("X-Signature")
		if signature == "" {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "missing signature"})
		}
		body, _ := c.Body()
		if !isValidSignature(body, signature) {
			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "invalid signature"})
		}
		webhookURL, ok := payloadMap["url"].(string)
		if !ok || webhookURL == "" {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "missing url"})
		}
		if !allowedWebhooks[webhookURL] {
			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "webhook destination not allowed"})
		}

		req, _ := http.NewRequest("POST", webhookURL, nil)
		req.Header.Set("Authorization", "Bearer "+serverAPIKey)
		client := &http.Client{}
		resp, err := client.Do(req)
		if err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "forwarding failed"})
		}
		defer resp.Body.Close()
		return c.SendStatus(resp.StatusCode)
	})

	app.Listen(":3000")
}

With HMAC-signed requests, the caller can suggest a webhook URL, but your server validates the signature before acting. The API key remains server-side and is only used for the outbound call after verification.