Header Injection in Fastapi with Api Keys

Header Injection occurs when an attacker is able to manipulate or inject arbitrary HTTP headers into a request that a server processes. In FastAPI applications that rely on API keys passed via headers, this can lead to authentication bypass, privilege escalation, or information leakage. API keys are commonly transmitted using headers such as X-API-Key or Authorization. If the application does not strictly validate the presence, format, and scope of these headers, an attacker may attempt to inject additional or malformed headers to influence routing, logging, or downstream services.

FastAPI itself does not introduce header injection flaws; the risk arises from how the application consumes and trusts header values. For example, if the API key is extracted from headers and used to construct requests to other services without proper sanitization, an attacker-supplied header such as X-Forwarded-For or X-Original-URL might be forwarded, enabling SSRF or cache poisoning. Similarly, case-insensitive header handling and duplicate headers can lead to unexpected behavior if the application logic does not account for them. The OpenAPI specification can help define expected headers, but only runtime validation and schema enforcement can reduce the likelihood of injection.

When scanning an API with API key authentication using middleBrick, the tool checks whether the API key is transmitted securely, whether headers are sanitized, and whether the server reflects or processes injected headers in an unsafe manner. This is part of the Authentication and Input Validation checks. An unauthenticated scan can detect whether the endpoint leaks information through error messages when malformed or injected headers are supplied. Because API keys are often static secrets, their exposure through logs or error responses due to header manipulation can lead to unauthorized access.

An example of a vulnerable FastAPI route might extract the API key directly from headers and pass it to another service without validation:

from fastapi import FastAPI, Request, Header, HTTPException

app = FastAPI()

@app.get("/data")
async def read_data(x_api_key: str = Header(None)):
    if not x_api_key or x_api_key != "super-secret-key":
        raise HTTPException(status_code=401, detail="Invalid API Key")
    # Unsafe use of header value
    return {"api_key_received": x_api_key}

While this snippet checks the API key value, it does not sanitize or normalize the header name, and it may be vulnerable to case-variant header injection depending on the underlying ASGI server and proxy setup. In a broader scan, middleBrick would flag missing input validation for header values and improper handling of duplicate or malformed headers as findings, highlighting the need for strict schema enforcement.

To mitigate header injection risks when using API keys in FastAPI, enforce strict header validation, normalize header names, and avoid using untrusted header values in downstream requests. Use Pydantic models for dependency injection where possible, and explicitly declare expected headers in your OpenAPI schema. This ensures that malformed or unexpected headers are rejected rather than processed.

Below is a secure example of an API key validation dependency in FastAPI using explicit header declaration and constant-time comparison to reduce timing attack risks:

from fastapi import FastAPI, Header, Depends, HTTPException, status
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
import secrets

app = FastAPI()

EXPECTED_API_KEY = "super-secret-key"

def verify_api_key(x_api_key: str = Header(..., alias="X-API-Key")):
    if not secrets.compare_digest(x_api_key, EXPECTED_API_KEY):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid API Key",
            headers={"WWW-Authenticate": "Bearer"},
        )
    return x_api_key

@app.get("/secure-data", dependencies=[Depends(verify_api_key)])
async def secure_data():
    return {"message": "Authenticated access granted"}

In this example, the header is declared with an explicit alias, and secrets.compare_digest is used to perform a constant-time string comparison, mitigating timing-based attacks. The route will only execute if the X-API-Key header matches the expected value. You can also extend this approach by using FastAPI dependencies to validate header formats, reject duplicate headers, and enforce constraints defined in your OpenAPI specification.

For broader protection, combine API key validation with other security practices such as rate limiting and transport encryption. middleBrick’s Pro plan supports continuous monitoring and CI/CD integration, which can help detect regressions in header handling or authentication logic before they reach production. The CLI can be used locally to validate endpoint behavior, and the Web Dashboard provides historical scoring and findings to track improvements over time.