Information Disclosure in Chi with Jwt Tokens

Information Disclosure in the context of Chi (a Clojure web framework) combined with JWT tokens occurs when a server unintentionally exposes sensitive data such as tokens, claims, or signing material through responses, logs, or error messages. Because Chi applications often rely on middleware to parse and validate JWTs, misconfigured routes or insecure default handlers can leak token contents or verification errors to clients.

During a scan, middleBrick tests unauthenticated attack surfaces and checks for information leakage in HTTP status codes, response bodies, and error traces. For JWT handling in Chi, common issues include verbose error messages that reveal whether a token was malformed, expired, or signed with a weak algorithm. These messages can give an attacker insight into the validation logic and help tailor tampering or replay attacks.

Real-world attack patterns such as Algorithm Confusion (CVE-2015-9235) and Token Leakage in Logs are relevant here. If a Chi handler echoes the token payload or includes the raw header in responses, an attacker can harvest credentials or impersonate users. Similarly, inconsistent handling of expired tokens may disclose timestamps or user identifiers in plaintext, violating principles of least privilege and data minimization.

middleBrick’s 12 security checks run in parallel and include Data Exposure and Input Validation assessments. When scanning a Chi-based API that uses JWT tokens, the scanner compares runtime behavior against the OpenAPI specification, if provided, and flags discrepancies such as missing authorization guards or overly permissive CORS settings. This helps identify whether JWT-related information disclosure occurs in unauthenticated endpoints.

Using the CLI, you can scan a Chi service from the terminal with middlebrick scan https://api.example.com to see if any findings reference JWT tokens, error details, or data exposure. The report will include severity-ranked items and remediation guidance, helping teams secure token handling before deploying to production.

To remediate Information Disclosure risks related to JWT tokens in Chi, ensure tokens are never reflected in responses, logs, or error payloads. Use strict validation, avoid exposing internal details, and structure middleware to handle failures uniformly without leaking context.

Example secure JWT validation in Chi using the clj-jwt library:

(ns myapp.core
  (:require [cheshire.core :as json]
            [clj-jwt.core :as jwt]
            [clj-jwt.decode :as jwt-decode]
            [compojure.core :refer [defroutes GET POST]]
            [ring.util.response :as resp]))

(defn verify-token [token]
  (try
    (let [decoded (jwt-decode/decode token {:alg :HS256 :key "super-secret-key"})]
      {:valid true :claims decoded})
    (catch Exception e
      {:valid false :error :invalid-token}))

(defn auth-handler [request]
  (let [auth-header (get-in request [:headers "authorization"])
        token (when auth-header (re-find #"Bearer\s+(\S+)" auth-header))]
    (if token
      (let [result (verify-token (second token))]
        (if (:valid result)
          (resp/response {:status "ok"})
          (resp/response {:error "Unauthorized"}))) ; Generic message, no details
      (resp/response {:error "Unauthorized"})))) ; Consistent response

(defroutes app-routes
  (GET "/secure" req (auth-handler req)))

Key practices include:

• Returning a generic error message such as {:error "Unauthorized"} regardless of whether the token is missing, malformed, or expired.
• Avoiding logging raw tokens or sensitive claims; if logging is necessary, mask or hash identifiers.
• Using strong algorithms (e.g., HS256 or RS256) and protecting the signing key via environment variables or a secrets manager.
• Ensuring CORS and route definitions do not expose token-related endpoints to untrusted origins.

middleBrick’s Pro plan supports continuous monitoring and CI/CD integration, so you can add API security checks to your pipeline and fail builds if risk scores degrade. This helps maintain secure JWT handling in Chi across deployments.