Man In The Middle in Flask with Hmac Signatures

In Flask, using HMAC signatures to authenticate HTTP requests is a common pattern to ensure integrity and authenticity. A server signs a payload with a shared secret and the client verifies or signs requests accordingly. However, when transport security is missing or inconsistently applied, this setup can enable a Man In The Middle (MitM) attack even with HMAC present.

HMAC guarantees that a message has not been altered in transit, but it does not prevent an attacker from observing or modifying an in-flight request if the communication channel is unencrypted. An attacker positioned on the network can intercept the plaintext request body, headers, and URL parameters. Because HMAC does not encrypt the payload, the attacker can read sensitive data. Additionally, if the client and server do not enforce strict validation of the request context (such as the exact set of signed headers and the request method), an attacker might be able to modify the request in ways that still produce a valid HMAC when combined with replay or parameter tampering.

A typical vulnerable pattern in Flask is signing only parts of the request, such as the JSON body, while neglecting headers like User-Agent, Accept, or custom routing headers. An attacker can change these unsigned headers without invalidating the signature, potentially altering behavior or enabling request smuggling. Another risk is failing to bind the signature to the HTTP method and the target path, which allows an attacker to reuse a valid signature across endpoints or methods (e.g., replaying a POST signature on a GET route that behaves differently).

Moreover, if the shared secret is transmitted or stored insecurely, or if the server uses a weak key derivation method, an attacker who compromises the server or the client can extract the secret and forge signatures. Even when TLS is used, implementation errors such as not validating certificates properly or accepting insecure cipher suites can weaken the channel. In such cases, an attacker capable of terminating or intercepting TLS (for example via a compromised CA or a misconfigured proxy) can perform a MitM and manipulate requests before they are verified by the server’s HMAC logic.

To illustrate, consider a Flask route that expects an HMAC-SHA256 signature in a custom header and processes the request without ensuring that the HTTP method and path are part of the signed string. An attacker who observes a valid signed POST to /transfer can replay that request against /transfer with altered parameters if the server does not enforce strict idempotency checks or nonce validation. Even if TLS is used, missing binding of signature to method and path enables logical tampering that HMAC alone cannot prevent.

Remediation focuses on ensuring that HMAC covers all components that must be immutable in transit, enforcing transport security, and validating context consistently. Below are concrete examples that demonstrate secure handling of HMAC signatures in Flask.

Secure HMAC verification with method, path, headers, and body

Sign and verify a canonical string that includes the HTTP method, the request path, selected headers, and the body. This prevents signature reuse across methods or paths and binds the signature tightly to the intended request.

import hmac
import hashlib
import time
from flask import Flask, request, abort, jsonify

app = Flask(__name__)
SHARED_SECRET = b'your-secure-secret-from-env'  # Load securely, e.g., os.environ.get('HMAC_SECRET')

def build_signature_string(method: str, path: str, headers: dict, body: bytes) -> str:
    # Canonicalize headers you intend to sign; avoid including hop-by-hop headers
    included_headers = {
        'content-type': headers.get('content-type', ''),
        'x-request-timestamp': headers.get('x-request-timestamp', ''),
    }
    header_part = '|'.join(f'{k.lower()}:{v.strip()}' for k, v in sorted(included_headers.items()) if v)
    return f'{method.upper()}|{path}|{header_part}|{body.decode("utf-8", errors="replace")}'

def verify_hmac(req_method: str, req_path: str, req_headers: dict, req_body: bytes, signature: str) -> bool:
    expected = build_signature_string(req_method, req_path, req_headers, req_body)
    mac = hmac.new(SHARED_SECRET, expected.encode('utf-8'), hashlib.sha256)
    return hmac.compare_digest(mac.hexdigest(), signature)

@app.route('/api/transfer', methods=['POST'])
def transfer():
    signature = request.headers.get('X-API-Signature')
    if signature is None:
        abort(400, 'Missing signature')
    # Ensure timestamp is validated to prevent replay; here we show a simple freshness check
    timestamp = request.headers.get('X-Request-Timestamp')
    if not timestamp or abs(time.time() - int(timestamp)) > 60:
        abort(400, 'Invalid or stale timestamp')
    if not verify_hmac(request.method, request.path, request.headers, request.get_data(), signature):
        abort(401, 'Invalid signature')
    return jsonify(status='ok')

if __name__ == '__main__':
    app.run(ssl_context='adhoc')  # Use proper TLS in production

The example builds a canonical string that includes method, path, selected headers, and body. It then computes HMAC-SHA256 and compares it securely using hmac.compare_digest to avoid timing attacks. Timestamp validation mitigates replay within the allowed window.

Client-side signing example

The client must construct the same canonical string and sign it with the shared secret before sending the request.

import hmac
import hashlib
import time
import requests

def build_client_signature(method: str, path: str, headers: dict, body: str) -> str:
    included_headers = {
        'content-type': headers.get('content-type', ''),
        'x-request-timestamp': headers.get('x-request-timestamp', ''),
    }
    header_part = '|'.join(f'{k.lower()}:{v.strip()}' for k, v in sorted(included_headers.items()) if v)
    return f'{method.upper()}|{path}|{header_part}|{body}'

shared_secret = b'your-secure-secret-from-env'
method = 'POST'
path = '/api/transfer'
body = '{"from":"A","to":"B","amount":100}'
headers = {
    'Content-Type': 'application/json',
    'X-Request-Timestamp': str(int(time.time())),
}
sig = build_client_signature(method, path, headers, body)
mac = hmac.new(shared_secret, sig.encode('utf-8'), hashlib.sha256).hexdigest()

response = requests.post(
    'https://api.example.com/api/transfer',
    json={'from': 'A', 'to': 'B', 'amount': 100},
    headers={
        **headers,
        'X-API-Signature': mac,
    },
    verify=True,  # Always verify TLS certificates
)
print(response.status_code, response.json())

Key remediation practices summarized:

• Include HTTP method, path, and critical headers in the signed string to prevent method/path substitution.
• Enforce TLS for all endpoints that carry HMAC-signed traffic and verify certificates strictly.
• Use a nonce or short-lived timestamp to prevent replay attacks; reject stale requests.
• Apply hmac.compare_digest for constant-time comparison to mitigate timing attacks.
• Store the shared secret securely and rotate it periodically; avoid hardcoding in source.