Missing Tls in Fiber with Hmac Signatures

Transport Layer Security (TLS) ensures confidentiality and integrity in transit between clients and servers. Running a Fiber application without TLS exposes all HTTP traffic, including Hmac Signatures, to network observers. Since Hmac Signatures rely on a shared secret to produce and verify message authentication codes, transmitting the signature or the data used to generate it over an unencrypted channel allows intermediaries to observe, copy, and potentially replay the values.

In a typical setup, a client might compute an Hmac over request parameters or a canonical string and send it in a header such as x-signature. If the request travels without TLS, an attacker on the same network can intercept the header and the payload. Even if the secret itself is not directly exposed, the attacker gains the inputs needed to recompute valid Hmac Signatures for modified or forged requests. This breaks the integrity guarantee that Hmac Signatures are meant to provide.

Additionally, without TLS, there is no server authentication in the form of a trusted certificate. Clients may unknowingly send Hmac Signatures and sensitive data to an impersonator, especially in environments where DNS spoofing or rogue access points are feasible. middleBrick scans such unauthenticated attack surfaces and flags the absence of TLS as a finding, noting that Hmac Signatures cannot protect integrity when transport confidentiality is missing.

Within the 12 parallel security checks, the absence of TLS intersects with Hmac Signature validation by highlighting that integrity controls are undermined when confidentiality is not enforced. For example, an endpoint expecting a timestamp to prevent replay attacks may still accept stale requests if TLS is missing, because an attacker can observe and reuse previously captured signed requests. The scanner surfaces this as a high-severity finding tied to data exposure and weak integrity enforcement.

To remediate the risk, enforce TLS for all endpoints in Fiber and ensure Hmac Signatures are generated and verified over encrypted channels. Below are concrete, syntactically correct examples for a Fiber service using Hmac Signatures with SHA256.

Enforce TLS in Fiber

Configure your Fiber app to use TLS by providing certificate and key files. This ensures all requests, including those containing Hmac Signatures, are encrypted in transit.

const fiber = require('fiber');
const https = require('https');
const fs = require('fs');

const app = fiber();

const options = {
  key: fs.readFileSync('/path/to/server.key'),
  cert: fs.readFileSync('/path/to/server.crt')
};

https.createServer(options, app).listen(443, () => {
  console.log('HTTPS server running on port 443');
});

Generate and Verify Hmac Signatures over HTTPS

Use a shared secret to sign requests on the client and verify on the server. The signature is computed over a canonical string, such as method, path, timestamp, and body, to prevent tampering.

Client-side signing example:

const crypto = require('crypto');

const method = 'POST';
const path = '/api/v1/resource';
const timestamp = Date.now().toString();
const body = JSON.stringify({ foo: 'bar' });
const secret = process.env.HMAC_SECRET;

const stringToSign = `${method}\n${path}\n${timestamp}\n${body}`;
const signature = crypto.createHmac('sha256', secret).update(stringToSign).digest('hex');

const headers = {
  'x-timestamp': timestamp,
  'x-signature': signature,
  'Content-Type': 'application/json'
};

// Make request over HTTPS
const https = require('https');
const req = https.request({
  hostname: 'api.example.com',
  port: 443,
  path: '/api/v1/resource',
  method: 'POST',
  headers: headers
}, res => { /* handle response */ });
req.write(body);
req.end();

Server-side verification in Fiber:

const crypto = require('crypto');
const fiber = require('fiber');
const app = fiber();

const HMAC_SECRET = process.env.HMAC_SECRET;

function verifyHmac(req, res, next) {
  const signature = req.get('x-signature');
  const timestamp = req.get('x-timestamp');
  const method = req.method;
  const path = req.path;
  const body = JSON.stringify(req.body);

  if (!signature || !timestamp) {
    res.status(400).send({ error: 'Missing signature or timestamp' });
    return;
  }

  // Basic replay protection: reject if older than 5 minutes
  const now = Date.now();
  if (Math.abs(now - parseInt(timestamp, 10)) > 5 * 60 * 1000) {
    res.status(400).send({ error: 'Request expired' });
    return;
  }

  const stringToSign = `${method}\n${path}\n${timestamp}\n${body}`;
  const expected = crypto.createHmac('sha256', HMAC_SECRET).update(stringToSign).digest('hex');

  // Use timing-safe compare to avoid timing attacks
  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    res.status(401).send({ error: 'Invalid signature' });
    return;
  }

  next();
}

app.post('/api/v1/resource', verifyHmac, (req, res) => {
  res.send({ ok: true });
});

These examples ensure Hmac Signatures are generated and verified only over TLS-protected connections, preserving integrity and confidentiality. middleBrick’s scans will validate the presence of TLS and the correct usage of Hmac Signatures, providing prioritized findings and remediation guidance aligned with OWASP API Top 10 and related compliance frameworks.