Replay Attack in Gorilla Mux with Basic Auth

A replay attack against an API using Gorilla Mux and HTTP Basic Authentication occurs when an intercepted authentication pair is reused by an attacker to gain unauthorized access. Basic Auth transmits credentials in an Authorization header encoded as Base64 (not encrypted), so any observer who can capture the header can extract the username and password. In a typical Gorilla Mux setup, routes are registered with router.HandleFunc("/account", accountHandler).Methods("GET"). If the handler relies solely on the presence of the Authorization header without additional protections, an attacker who observes a valid request can replay it later to perform actions as the victim.

Because Basic Auth is static per request, replay is especially dangerous when requests are not bound to a nonce, timestamp, or per-request token. For example, an attacker on the same network can capture the header with a tool like Wireshark or a proxy, then replay the identical HTTP request to endpoints like /transfer or /status. MiddleBrick’s unauthenticated scan tests endpoints for missing replay protections by observing whether the same request yields the same or different outcomes, flagging cases where replay could lead to unauthorized transfers or data access.

The risk is compounded when APIs do not enforce TLS for every request, because Base64-encoded credentials can be decoded trivially if traffic is observed in cleartext. Additionally, if the application does not include server-side protections such as request IDs, timestamps, or idempotency keys, the API has no way to detect that a request is a duplicate of a previously seen one. MiddleBrick’s checks include input validation and rate limiting, but replay is specifically about the reuse of otherwise valid credentials; without per-request randomness or cryptographic binding, Basic Auth in Gorilla Mux remains vulnerable.

Because this is a black-box scan, MiddleBrick evaluates whether endpoints using Basic Auth exhibit replay-prone behavior by sending the same request twice and comparing responses, status codes, and side effects. If identical inputs produce identical outputs without server-side anti-replay mechanisms, the scan will surface a high-severity finding tied to authentication and data exposure. Developers should treat Basic Auth as a transport-level credential mechanism and layer additional protections to prevent replay.

To mitigate replay with Basic Auth in Gorilla Mux, combine HTTPS enforcement, one-time nonces or timestamps, and server-side validation. The following example shows a handler that requires TLS, validates the Authorization header on every request, and rejects requests with stale timestamps.

import (
    "crypto/tls"
    "net/http"
    "strings"
    "time"
)

func secureAccountHandler(w http.ResponseWriter, r *http.Request) {
    auth := r.Header.Get("Authorization")
    if auth == "" || !strings.HasPrefix(auth, "Basic ") {
        http.Error(w, "Unauthorized", http.StatusUnauthorized)
        return
    }
    // Validate timestamp to prevent replay
    ts := r.Header.Get("X-Request-Timestamp")
    if ts == "" {
        http.Error(w, "Missing timestamp", http.StatusBadRequest)
        return
    }
    reqTime, err := time.Parse(time.RFC3339, ts)
    if err != nil || time.Since(reqTime) > 2*time.Minute {
        http.Error(w, "Stale request", http.StatusForbidden)
        return
    }
    // Basic Auth credentials validation (use a secure lookup)
    // Example: verify username/password against a secure store
    if !isValidBasicAuth(auth) {
        http.Error(w, "Invalid credentials", http.StatusUnauthorized)
        return
    }
    w.WriteHeader(http.StatusOK)
    w.Write([]byte("OK"))
}

func isValidBasicAuth(auth string) bool {
    // Implement secure credential verification, e.g., constant-time compare
    return true // placeholder
}

func main() {
    router := mux.NewRouter()
    router.HandleFunc("/account", secureAccountHandler).Methods("GET")
    srv := &http.Server{
        Addr:      ":8443",
        Handler:   router,
        TLSConfig: &tls.Config{MinVersion: tls.VersionTLS12},
    }
    srv.ListenAndServeTLS("/path/to/cert.pem", "/path/to/key.pem")
}

In this pattern, each request must include an X-Request-Timestamp header formatted as RFC3339. The server checks that the timestamp is recent (for example, within two minutes), which prevents an attacker from reusing a captured request after this window. Enforcing TLS via ListenAndServeTLS ensures that credentials are not exposed in transit, and using a secure validation function avoids timing attacks on the credentials.

You can integrate continuous scanning into your workflow by using the CLI tool: middlebrick scan <url> to detect missing replay protections, or add the GitHub Action to your CI/CD pipeline to fail builds if risk scores drop below your chosen threshold. For teams that require ongoing oversight, the Pro plan provides continuous monitoring so that new endpoints or changes to authentication logic are automatically tested for replay and other authentication weaknesses.