Man In The Middle in Gorilla Mux with Basic Auth

Gorilla Mux is a widely used HTTP router for Go that matches incoming requests against registered routes. When Basic Auth is implemented at the handler level, transport-layer protections are assumed rather than enforced. A Man In The Middle (MitM) scenario arises when an attacker can observe or alter traffic between the client and server, for example on shared networks, compromised access points, or insecure load balancers. Because Basic Auth transmits credentials in an easily decoded format, an intercepting adversary can recover the username and password unless TLS is consistently applied and verified end-to-end.

In Gorilla Mux, routes are matched before handlers are invoked; if a route is registered without requiring TLS, an attacker who can position themselves between client and server can downgrade or intercept unencrypted requests. Even when TLS is used, insufficient certificate validation on the client side (e.g., skipping VerifyPeerCertificate or using InsecureSkipVerify) can enable MitM. Once credentials are captured, the attacker can replay them to gain unauthorized access, bypassing intended authorization boundaries enforced by Gorilla Mux handlers. This is especially risky when authentication is performed per-route and some routes omit strict transport checks, creating inconsistent security posture across the same service.

The interplay of Gorilla Mux’s flexible routing and Basic Auth’s lack of inherent confidentiality means developers must explicitly enforce HTTPS for all routes and avoid conditional TLS usage. Without consistent encryption, MitM can trivially undermine the router’s access controls. MiddleBrick’s unauthenticated scans can detect whether endpoints are served over cleartext HTTP, flagging missing transport protections as a high-severity finding in the Encryption and Authentication checks.

Remediation focuses on enforcing transport security and validating credentials on every request. Always serve APIs exclusively over HTTPS and reject cleartext HTTP. In Gorilla Mux, use middleware to inspect the request’s TLS state before authentication proceeds. Below is a minimal, secure example that combines Gorilla Mux routing with Basic Auth verification and strict transport checks.

//go
package main

import (
	"crypto/tls"
	"encoding/base64"
	"fmt"
	"net/http"
	"strings"

	"github.com/gorilla/mux"
)

// secureMiddleware ensures the request is served over TLS before allowing Basic Auth checks.
func secureMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.TLS == nil {
			http.Error(w, "TLS required", http.StatusForbidden)
			return
		}
		next.ServeHTTP(w, r)
	})
}

// basicAuthMiddleware validates Authorization header against a hardcoded user:pass pair.
// In production, use a secure lookup (e.g., constant-time compare against a vault).
func basicAuthMiddleware(next http.Handler) http.Handler {
	const user, pass = "apiuser", "s3cr3t"
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		auth := r.Header.Get("Authorization")
		if auth == "" {
			http.Error(w, "Authorization header required", http.StatusUnauthorized)
			return
		}
		const prefix = "Basic "
		if !strings.HasPrefix(auth, prefix) {
			http.Error(w, "Invalid authorization type", http.StatusUnauthorized)
			return
		}\tpayload, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
		if err != nil {
			http.Error(w, "Invalid authorization header", http.StatusUnauthorized)
			return
		}
		pair := string(payload)
		if pair != user+":"+pass {
			http.Error(w, "Forbidden", http.StatusForbidden)
			return
		}
		next.ServeHTTP(w, r)
	})
}

func healthHandler(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintf(w, "ok")
}

func main() {
	router := mux.NewRouter()
	router.HandleFunc("/health", healthHandler).Methods("GET")

	// Apply middleware stack: transport security first, then auth.
	stack := secureMiddleware(basicAuthMiddleware(router))

	srv := &http.Server{
		Addr:    ":8443",
		Handler: stack,
		TLSConfig: &tls.Config{
			MinVersion: tls.VersionTLS12,
		},
	}

	// Use real certificates in production; this is an example.
	if err := srv.ListenAndServeTLS("server.crt", "server.key"); err != nil {
		panic(err)
	}
}

Key points:

• Always enforce TLS via middleware before authentication logic; reject non-TLS requests with 403 Forbidden.
• Use strong credentials and avoid hardcoding secrets in source; integrate with a secrets manager in production.
• Set MinVersion: tls.VersionTLS12 (or TLS 1.3) to prevent downgrade attacks.
• Validate the full handshake state (r.TLS) rather than relying on external proxies to enforce encryption.

For ongoing assurance, use tools like MiddleBrick to verify that all routes require encryption and that no mixed-content scenarios exist. These scans map findings to frameworks such as OWASP API Top 10 and PCI-DSS, helping prioritize remediation.