Header Injection in Echo Go with Bearer Tokens

Header Injection in the Echo framework occurs when user-controlled input is placed directly into HTTP response headers without validation or sanitization. When Bearer Tokens are handled in Echo routes—typically via the Authorization header—improper handling can enable injection of additional headers, token manipulation, or token leakage across components. For example, if an Echo handler reads a token from a request header or query parameter and then sets it in another response header without validation, an attacker can inject newline characters (e.g., \r\n) to append or override headers such as Set-Cookie, X-Content-Type-Options, or custom security headers.

In Echo Go, route handlers often parse Authorization headers using the format "Bearer ". If the token string is later reflected in other headers or logs without sanitization, newline or carriage return injection can split the header block and inject malicious directives. This becomes particularly dangerous when tokens contain attacker-controlled characters that are echoed back in Set-Cookie or Location headers, enabling session fixation or cross-user token leakage. Even when tokens originate from a trusted source, reflecting them verbatim into response headers violates the principle of separation between request context and response metadata.

The combination of Echo’s flexible routing and middleware capabilities with Bearer Token workflows increases risk if developers assume tokens are safe because they are structured. An attacker who can influence the Authorization header can exploit improper concatenation or formatting in handlers to inject extra headers. For instance, a token like "abc\r\nX-Injected: true" can trick naive string handling into creating two separate headers. This can lead to security-relevant side effects such as bypassing browser protections or altering caching behavior. Because Bearer Tokens are often treated as opaque strings, developers may overlook the need to validate or sanitize them before using them in broader request processing pipelines.

middleBrick detects scenarios where API responses reflect token-like values in headers and flags Header Injection as a finding with severity High. The scanner does not assume trust in the format of Authorization values and checks whether user-influenced data reaches response headers without canonicalization. By testing unauthenticated attack surfaces, it identifies endpoints where header manipulation is possible, even when tokens follow the Bearer scheme pattern. This is important because the vulnerability exists regardless of whether the token is valid; the risk is in how the application handles and reflects token input.

To reduce risk, treat Bearer Tokens as untrusted input, validate their format, and avoid echoing them into response headers or logs. Use strict parsing to extract the token value rather than string manipulation, and apply output encoding for any values that may reach headers. Leverage middleware to centralize header handling and ensure that security-sensitive headers are set explicitly rather than derived from request data.

Remediation focuses on strict parsing, avoiding reflection of raw token values into headers, and ensuring that token handling does not introduce injection vectors. Below are concrete, idiomatic examples for secure handling in Echo Go.

• Validate and extract Bearer tokens without reflection

func secureHandler(c echo.Context) error {
    auth := c.Request().Header.Get("Authorization")
    const bearerPrefix = "Bearer "
    if !strings.HasPrefix(auth, bearerPrefix) {
        return echo.NewHTTPError(http.StatusUnauthorized, "invalid authorization header")
    }
    token := auth[len(bearerPrefix):]
    if token == "" {
        return echo.NewHTTPError(http.StatusBadRequest, "missing token")
    }
    // Use token for backend call, not for setting headers
    return c.JSON(http.StatusOK, map[string]string{"status": "ok"})
}

• Avoid setting user-influenced values in response headers

// BAD: echo.HeaderMap.Set("X-Bearer-Token", token) — do not reflect token in headers
// GOOD: keep token usage confined to request context or secure storage
func proxyHandler(c echo.Context) error {
    auth := c.Request().Header.Get("Authorization")
    const bearerPrefix = "Bearer "
    if !strings.HasPrefix(auth, bearerPrefix) {
        return echo.NewHTTPError(http.StatusUnauthorized, "invalid authorization header")
    }
    token := auth[len(bearerPrefix):]
    // Use token to call another service, but do not set it in response headers
    req, _ := http.NewRequest(http.MethodGet, "https://upstream.example.com/resource", nil)
    req.Header.Set("Authorization", auth)
    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        return echo.NewHTTPError(http.StatusBadGateway, "upstream error")
    }
    defer resp.Body.Close()
    return c.JSONBlob(resp.StatusCode, /* body from upstream */ nil)
}

• Sanitize and restrict characters if token must be echoed (e.g., in JSON body only)

func sanitizeAndRespond(c echo.Context) error {
    auth := c.Request().Header.Get("Authorization")
    const bearerPrefix = "Bearer "
    if !strings.HasPrefix(auth, bearerPrefix) {
        return echo.NewHTTPError(http.StatusUnauthorized, "invalid authorization header")
    }
    token := auth[len(bearerPrefix):]
    // Allow only token-safe characters; reject newlines, carriage returns, and control chars
    if strings.ContainsAny(token, "\r\n") {
        return echo.NewHTTPError(http.StatusBadRequest, "token contains invalid characters")
    }
    // If you must include token in response body, ensure proper encoding and avoid headers
    return c.JSON(http.StatusOK, map[string]string{"token_ref": "redacted", "hash": fmt.Sprintf("%x", sha256.Sum256([]byte(token)))})
}

• Use middleware for centralized header security

func headerSecurityMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
    return func(c echo.Context) error {
        // Ensure no injected headers in responses by sanitizing known risky headers
        c.Response().Header().Del("X-Injected-Header")
        return next(c)
    }
}

func main() {
    e := echo.New()
    e.Use(headerSecurityMiddleware)
    e.GET("/secure", secureHandler)
    e.Logger.Fatal(e.Start(":8080"))
}

These examples emphasize strict validation, avoiding reflection of raw tokens into headers, and using middleware to enforce security boundaries. They align with remediation guidance provided by scanning tools that highlight Header Injection when tokens appear in response headers.