Header Injection in Fastapi with Cockroachdb

Header Injection in a Fastapi application using Cockroachdb typically arises when user-controlled input influences HTTP response headers or is interpolated into SQL statements without proper handling. In Fastapi, route parameters, query strings, or JSON payloads can inadvertently flow into header construction logic, enabling injection through crafted header names or values. When those values are later used in database operations—such as building dynamic SQL for Cockroachdb—unsafe concatenation may expose the application to injection or data leakage.

Cockroachdb is PostgreSQL-wire compatible, so common SQL injection techniques (e.g., concatenating identifiers or values into queries) apply. If Fastapi builds SQL strings using header-derived values (for example, a tenant identifier from a custom header to select a schema or to filter rows), and does not parameterize or validate those values, an attacker can manipulate headers to alter query structure. This can lead to unauthorized data access across tenants, schema probing, or injection of additional SQL fragments. In a multi-tenant design, a header like x-tenant-id used directly in string formatting is a typical vector.

The risk is compounded when OpenAPI/Swagger specs describe header parameters without enforcing strict validation formats. middleBrick’s checks for Input Validation and Property Authorization highlight cases where header values reach database logic without sanitization or schema-bound parameterization. Because Cockroachdb supports prepared statements and parameterized queries, the framework should leverage them rather than assembling SQL via string interpolation. middleBrick’s scans test unauthenticated attack surfaces and can flag endpoints where header-driven behavior reaches the database layer, mapping findings to OWASP API Top 10 and compliance frameworks.

Remediation centers on strict input validation, using parameterized SQL, and avoiding header values in SQL construction. In Fastapi, declare explicit header models with Pydantic and enforce strict patterns (e.g., tenant IDs limited to alphanumeric and underscores). Never directly inject header values into SQL strings. Instead, use Cockroachdb’s parameterized queries with asyncpg or psycopg (async) to ensure values are sent separately from the command text.

Example of unsafe code to avoid:

import sqlite3  # placeholder; in Cockroachdb you'd use asyncpg/psycopg
# UNSAFE: directly interpolating header into SQL
sql = f"SELECT * FROM tenants WHERE id = '{tenant_id}'"
cursor.execute(sql)  # vulnerable to injection

Secure, Cockroachdb-specific approach using parameterized queries with asyncpg:

from fastapi import FastAPI, Header, HTTPException
import asyncpg
import re

app = FastAPI()

# Validate tenant ID to expected pattern
def validate_tenant_id(tenant_id: str) -> bool:
    return re.match(r'^[a-zA-Z0-9_]{1,64}$', tenant_id) is not None

@app.get("/items/{item_id}")
async def read_item(
    item_id: int,
    x_tenant_id: str = Header(..., alias="X-Tenant-ID")
):
    if not validate_tenant_id(x_tenant_id):
        raise HTTPException(status_code=400, detail="Invalid tenant ID")
    conn: asyncpg.Connection = await asyncpg.connect(
        host="your-cockroachdb-host",
        port=26257,
        user="your_user",
        password="your_password",
        database="your_db"
    )
    try:
        # SAFE: parameterized query; tenant_id is passed as a parameter
        rows = await conn.fetch(
            "SELECT data FROM tenant_data WHERE tenant_id = $1 AND item_id = $2",
            x_tenant_id, item_id
        )
        return [dict(r) for r in rows]
    finally:
        await conn.close()

For schema-qualified queries, pass identifiers as literals where supported by the driver’s parameterization rules; if dynamic database/table names are required, use strict allow-lists and never concatenate raw header values. middleBrick’s scans can verify that endpoints using Cockroachdb employ parameterization by correlating spec definitions with runtime tests, ensuring header values do not reach SQL verbatim.