Race Condition in Chi with Mutual Tls

A race condition in a Chi application using Mutual TLS occurs when the security outcome depends on the timing or ordering of concurrent operations, such as certificate verification and request processing. Chi is a functional, compositional web framework for Clojure, and when it terminates a request handler, control may return to the runtime in an intermediate state. If multiple requests share resources that are lazily initialized after TLS handshake completion—such as cached connections, per-request state, or lazy-loaded configuration—concurrent execution can cause one request to observe inconsistent or uninitialized data while another is still configuring secure session state.

Mutual TLS requires both client and server to present valid certificates. In Chi, this typically means configuring an HTTPS server with client-certificate verification enabled. The verification step may complete successfully, but if the application defers authorization checks or resource allocation until after the handler body runs, a window exists where a partially initialized secure session is used to access shared state. An attacker can send many rapid requests with valid client certificates; the race manifests as one request seeing the effects of another request’s incomplete authorization or caching logic. This can lead to privilege escalation, information disclosure, or inconsistent enforcement of authorization rules across concurrent connections.

For example, if you derive per-request authorization context from a lazy map that is populated after certificate validation but before handler execution, concurrent requests may read a partially populated map. Because Mutual TLS ensures identity, the application may incorrectly assume the context is fully established and skip further checks. This is a classic time-of-check-to-time-of-use (TOCTOU) pattern, where the check (certificate validation) and use (handler logic) are not atomic with respect to shared mutable state.

Chi itself does not introduce this class of concurrency bugs, but its composability and use of lazy effects can expose timing-sensitive interactions between TLS session establishment and business logic. Because Mutual TLS binds identity to the connection, the race can be exploited by an authenticated client that manipulates scheduling to observe intermediate states. The risk is higher when handlers perform asynchronous work or when the application shares caches across requests without synchronization, even though each connection is cryptographically authenticated.

Notably, middleBrick scans unauthenticated attack surfaces and can detect indicators of such concurrency-related misconfigurations when testing API endpoints. For APIs with OpenAPI/Swagger specs, cross-referencing spec definitions with runtime findings helps highlight mismatches between declared security schemes and actual runtime behavior. While middleBrick does not fix the bug, its findings include remediation guidance to help developers tighten synchronization and ensure authorization logic follows identity validation in all concurrent paths.

To eliminate race conditions when using Mutual TLS in Chi, ensure that all authorization and resource initialization based on certificate identity is performed atomically within the request-handling pipeline, and avoid sharing mutable state across requests without proper synchronization.

1. Initialize request context synchronously after client cert validation

In Chi, you can use route middleware to validate client certificates and build request context before the handler runs. By constructing an immutable context and passing it to the handler, you close the window where partial state is visible to concurrent requests.

(ns myapp.core
  (:require [cheshire.core :as json]
            [clojure.core.async :refer [go <!]]
            [ring.adapter.jetty.https :as jetty-https]
            [ring.middleware.params :refer [wrap-params]]
            [ring.util.response :as resp]))

(defn client-cert-identity [request]
  (or (get-in request [:ssl-client-cert :subject]) "unknown"))

(defn wrap-authz-context [handler]
  (fn [request]
    ;; Build context atomically after TLS handshake
    (let [identity (client-cert-identity request)
          context {:identity identity
                   :permissions (fetch-permissions identity)}]
      (handler (assoc request :authz-context context)))))

(def app
  (-> (routes
        (GET "/profile" request
          (let [ctx (:authz-context request)]
            (resp/json-response {:user (:identity ctx)
                                 :roles (:permissions ctx)})))
        (wrap-authz-context)))
    wrap-params))

2. Avoid lazy or shared caches for authorization-derived data

If you must cache results derived from certificate identity, use a concurrency-safe structure and ensure cache keys include the identity so that one request cannot observe another’s incomplete entry.

(ns myapp.cache
  (:import (java ConcurrentHashMap)))

(def ^:private permissions-cache (ConcurrentHashMap.))

(defn get-or-fetch-permissions [identity]
  (.computeIfAbsent permissions-cache identity
    (fn [_] (fetch-permissions-from-db identity))))

(defn fetch-permissions [identity]
  ;; Ensure this function is side-effect free and idempotent
  (get-or-fetch-permissions identity))

3. Use middleware to enforce ordering of checks

Chi encourages composing small middleware functions. Place Mutual TLS verification early in the stack, then immediately derive authorization context, and finally apply any business logic. This ordering prevents handlers from executing under an unverified or partial authorization state.

(def app
  (-> app
      (wrap-ssl-client-verify)          ;; Mutual TLS verification
      wrap-authz-context                ;; Derive context synchronously
      wrap-params
      (route/router routes)))

4. Example Mutual TLS configuration for Jetty (used by some Chi deployments)

Ensure your server is configured to request and validate client certificates. This snippet shows how to set up a Jetty connector that requires client authentication, which complements Chi’s middleware composition.

(def ssl-context
  (doto (SSLContext/getInstance "TLS")
    (.init nil (into-array TrustManager [(trust-manager-from-store "resources/truststore.jks")])
           (into-array SecureRandom. [(SecureRandom.))])))

(def server
  (jetty/run-jetty app
    {:ssl-context ssl-context
     :client-auth :need
     :trust-store "resources/truststore.jks"
     :key-store "resources/keystore.jks"
     :port 8443}))

By synchronizing identity validation with context construction and avoiding shared mutable state, you close the race window. middleBrick can help verify that your API endpoints correctly declare Mutual TLS requirements and that runtime behavior aligns with the spec, though remediation remains a developer responsibility.