Phishing Api Keys in Echo Go with Cockroachdb

When an Echo Go service uses Cockroachdb as its backend datastore, mishandling of API keys can create phishing conditions that enable unauthorized database access. If API keys are embedded in client-side JavaScript, served over unencrypted channels, or logged in application logs, they can be harvested by phishing pages that mimic your authentication flows. An attacker might deliver a convincing login page that captures credentials and API keys, then use those keys to construct direct Cockroachdb connection strings.

In this stack, API keys often function as bearer tokens for database access or as components used to derive session cookies. If an attacker obtains a key via phishing, they can connect directly to Cockroachdb using the SQL protocol, bypassing the application layer entirely. This is especially risky when the database accepts connections from broad IP ranges and the API key is long-lived or overly privileged. The risk is compounded if the key is stored in environment variables that are inadvertently exposed through debug endpoints or error messages returned by Echo Go routes.

Another vector involves open redirects or insecure callback URLs in the Echo Go application. An attacker can craft a phishing link that includes a valid API key as a query parameter, and if the application logs these URLs (for example, in access logs or error traces), the key can be exfiltrated to an external server. Cockroachdb’s connection strings may contain the key or a derived credential, and if those logs are ever leaked or searched by an attacker, the keys become phishable through social engineering or compromised log storage.

Because middleBrick tests unauthenticated attack surfaces and checks Data Exposure and Input Validation, it can identify endpoints that leak keys in responses or error messages. The scanner also checks for SSL/TLS Encryption, ensuring keys are not transmitted in cleartext, and examines whether the API surface inadvertently exposes database connection details that facilitate phishing. These checks highlight insecure configurations that make key phishing feasible in the Echo Go + Cockroachdb context.

Remediation focuses on preventing API key exposure in the Echo Go application and tightening Cockroachdb access. Never embed database credentials in client-side code or logs. Use short-lived, scoped credentials and enforce strict network controls.

1. Use CockroachDB connection pools with scoped credentials

Instead of a single long-lived API key, create role-based users in Cockroachdb and supply per-request credentials via environment variables injected by your runtime. This limits blast radius if a key is phished.

// echo/main.go
package main

import (
	"context"
	"database/sql"
	"os"
	"time"

	"github.com/labstack/echo/v4"
	_ "github.com/lib/pq"
)

func main() {
	e := echo.New()

	// Read database configuration securely at startup
	dbHost := os.Getenv("DB_HOST")
	dbPort := os.Getenv("DB_PORT")
	dbUser := os.Getenv("DB_USER")
	dbPassword := os.Getenv("DB_PASSWORD")
	dbName := os.Getenv("DB_NAME")
	dbSSLMode := os.Getenv("DB_SSLMODE")

	connStr := "host=" + dbHost + " port=" + dbPort + " user=" + dbUser +
		" password=" + dbPassword + " dbname=" + dbName + " sslmode=" + dbSSLMode

	db, err := sql.Open("postgres", connStr)
	if err != nil {
		e.Logger.Fatal("failed to connect to cockroachdb: ", err)
	}
	defer db.Close()

	// Configure connection pool for safety and performance
	db.SetMaxOpenConns(25)
	db.SetMaxIdleConns(5)
	db.SetConnMaxLifetime(5 * time.Minute)

	e.GET("/profile/:id", func(c echo.Context) error {
		ctx := c.Request().Context()
		var username string
		// Use parameterized queries to prevent injection
		err := db.QueryRowContext(ctx, "SELECT username FROM users WHERE id = $1", c.Param("id")).Scan(&username)
		if err != nil {
			return c.String(500, "internal error")
		}
		return c.String(200, "Hello, "+username)
	})

	e.Logger.Fatal(e.Start(":8080"))
}

2. Rotate keys and enforce least privilege in Cockroachdb

Create users with minimal required privileges and rotate credentials regularly. Avoid using the root or admin user for application connections.

-- Cockroachdb SQL example
-- Create a limited-privilege user for the Echo Go app
CREATE USER app_reader WITH PASSWORD 'strong-password-here';
GRANT SELECT ON TABLE public.users TO app_reader;
-- Revoke dangerous privileges
REVOKE CREATE, DROP, DELETE ON ALL TABLES IN SCHEMA public FROM app_reader;

3. Secure transmission and storage

Serve your Echo Go application exclusively over TLS and store database credentials in secure runtime injection (e.g., container secrets) rather than in code or logs. Validate and sanitize all inputs to prevent injection that could expose keys via error messages.

// Enforce HTTPS redirect in Echo Go
func secureMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		if c.Request().TLS == nil {
			return c.Redirect(301, "https://"+c.Request().Host+c.Request().URL.String())
		}
		return next(c)
	}
}

4. Avoid logging sensitive data

Ensure that request and error logging do not capture API keys, passwords, or connection strings. Use structured logging with field-level redaction for sensitive headers and query parameters.