Phishing Api Keys in Chi with Basic Auth

In Chi, Basic Authentication sends credentials as an Authorization header that is base64-encoded but not encrypted. If an API key is embedded in the Basic credentials (for example, Authorization: Basic base64(apiKey:)), the key can be extracted by an attacker who intercepts or logs the request. Phishing becomes viable when a malicious site or email convinces a user or client to send requests with those same credentials to a hostile endpoint, effectively harvesting the API key.

During an unauthenticated black-box scan, middleBrick tests for this by probing endpoints that accept Basic Auth and observing whether credentials are transmitted in cleartext over non-TLS channels and whether the same key material appears in logs, error messages, or client-side code. The scan’s Data Exposure and Encryption checks surface cleartext transmission and missing TLS requirements, while the LLM/AI Security checks detect system prompt leakage and active prompt injection probes that can trick a developer or user into revealing credentials used in Basic Auth headers.

Additionally, the Inventory Management and Unsafe Consumption checks examine how API keys are stored and reused across services. When the same key is used both as an API credential and as a Basic credential, a phishing lure that captures Basic Auth can lead to direct compromise of the API. The scanner correlates runtime observations with OpenAPI/Swagger specs (including full $ref resolution) to verify whether authentication schemes explicitly require TLS and whether credentials are documented as sensitive, highlighting gaps that make phishing feasible.

Real-world attack patterns include SSRF combined with credential exfiltration, where an internal service that uses Basic Auth is tricked into sending requests to an attacker-controlled server, and insecure consumption of third-party APIs that accept Basic credentials without enforcing strict referrer or origin checks. These behaviors are flagged with severity and remediation guidance in the middleBrick report, helping teams understand how phishing against Basic Auth in Chi can expose API keys.

Remediation focuses on removing API keys from Basic Auth, enforcing TLS, and using dedicated authentication mechanisms. Never embed API keys in the Basic credentials username or password, and avoid sending API keys in headers that are only base64-encoded.

Example 1: Migrate to Bearer tokens with HTTPS

// Chi server route enforcing Bearer token over TLS
import { createApp, defineEventHandler, setResponseHeader } from 'h3';

const app = createApp();

app.use('/*', (event) => {
  const auth = event.node.req.headers.authorization;
  if (!auth || !auth.startsWith('Bearer ')) {
    setResponseHeader(event, 'WWW-Authenticate', 'Bearer realm="api"');
    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
  }
  const token = auth.slice(7);
  if (token !== process.env.API_TOKEN) {
    throw createError({ statusCode: 403, statusMessage: 'Forbidden' });
  }
});

export default app;

Example 2: Client request using Bearer token

// Chi client request with Bearer token
import { $fetch } from 'ohmyfetch';

const apiToken = process.env.API_TOKEN;

await $fetch('https://api.example.com/v1/resource', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${apiToken}`
  },
  timeout: 10000,
  retry: 1
});

Example 3: If Basic Auth is required, enforce TLS and rotate credentials

// Chi server ensuring TLS and rejecting cleartext HTTP
import { createApp, defineEventHandler, setResponseHeader } from 'h3';

const app = createApp();

app.use('/*', (event) => {
  const isHttps = event.node.req.socket.encrypted;
  if (!isHttps) {
    throw createError({ statusCode: 400, statusMessage: 'HTTPS required' });
  }
  const auth = event.node.req.headers.authorization;
  if (!auth || !auth.startsWith('Basic ')) {
    setResponseHeader(event, 'WWW-Authenticate', 'Basic realm="api"');
    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
  }
  // Validate against a rotated credential store; do not use static keys
  const expected = process.env.BASIC_CREDENTIALS; // base64 encoded user:password
  if (auth !== `Basic ${expected}`) {
    throw createError({ statusCode: 403, statusMessage: 'Forbidden' });
  }
});

export default app;

In all cases, ensure TLS is enforced and that API keys are stored as secrets in environment variables, not embedded in Basic credentials. middleBrick’s Pro continuous monitoring can alert you when endpoints unexpectedly accept Basic Auth without TLS, and the GitHub Action can fail builds if insecure authentication schemes are detected before deployment.