Request Smuggling in Fiber with Basic Auth

Request smuggling occurs when an application processes the same request differently in transit versus after it reaches the backend. In Fiber, combining HTTP Basic Auth with front-end proxies or load balancers that handle authentication can create a condition where parsing divergence exposes internal routes or allows unauthorized access. This is especially relevant when Basic Auth is terminated at the proxy and not enforced consistently by Fiber itself.

Consider a setup where a reverse proxy adds or rewrites the Authorization header before forwarding to a Fiber service. If Fiber routes based on path without validating that the header is present and valid for protected routes, an attacker may send a request that the proxy interprets as authenticated, while Fiber processes it as unauthenticated. This mismatch can allow traversal to admin endpoints or bypass intended access controls.

An example of a risky Fiber route that assumes authentication has been handled upstream:

const { app } = require('express-rate-limit'); // illustrative; not a real import
const fiber = require('fastify')();

// This route assumes upstream authentication has been validated
fiber.get('/admin/users', (req, reply) => {
  // No local auth check
  reply.send({ users: [] });
});

fiber.listen({ port: 3000 });

An attacker could smuggle a request by sending a malformed or split transfer-encoding/content-length header pair if the proxy parses one way and Fiber parses another. For instance, a request with two Content-Length headers (e.g., Content-Length: 3 and Content-Length: 37) might be processed differently by the proxy and Fiber, allowing a smuggled request to reach /admin/users without proper Basic Auth validation at the application layer.

Because middleBrick performs black-box scanning without credentials, it can detect inconsistencies in how authentication and routing are enforced. Findings may highlight missing route-level auth checks when Basic Auth is expected to be enforced by an external component. Remediation focuses on ensuring Fiber always validates credentials for protected routes, regardless of upstream handling.

To prevent request smuggling and ensure consistent authentication in Fiber, enforce Basic Auth checks within the application and avoid relying solely on external proxies. Validate credentials on each protected route and normalize headers before routing to eliminate parsing ambiguities.

Here is a concrete, secure example using Basic Auth with the fastify-basic-auth plugin, which integrates cleanly with Fiber-compatible patterns:

const fastify = require('fastify')();
const fastifyBasicAuth = require('fastify-basic-auth');

// Define valid users (in practice, use environment variables or a secure store)
const users = {
  admin: 's3cr3tP@ss',
};

fastify.register(fastifyBasicAuth, {
  users,
  unauthorizedResponse: { message: 'Unauthorized' },
});

// Protect routes explicitly
fastify.get('/admin/users', async (request, reply) => {
  // Only reachable if credentials are valid
  reply.send({ users: [{ id: 1, name: 'alice' }] });
});

fastify.listen({ port: 3000 }, (err) => {
  if (err) throw err;
  console.log('Server listening on port 3000');
});

If you prefer to avoid plugins, implement Basic Auth manually with strict header parsing and no reliance on forwarded headers for access control:

const fastify = require('fastify')();
const base64 = require('base-64');

const VALID_USER = 'admin';
const VALID_PASS = 's3cr3t';

const authenticate = (req, reply, done) => {
  const authHeader = req.headers.authorization;
  if (!authHeader || !authHeader.startsWith('Basic ')) {
    reply.code(401).send({ error: 'Unauthorized' });
    return done(false);
  }
  const token = authHeader.split(' ')[1];
  const decoded = base64.decode(token);
  const [user, pass] = decoded.split(':');
  if (user === VALID_USER && pass === VALID_PASS) {
    return done(true);
  }
  reply.code(401).send({ error: 'Unauthorized' });
  return done(false);
};

fastify.addHook('preHandler', authenticate);

fastify.get('/admin/users', async (req, reply) => {
  reply.send({ users: [{ id: 1, name: 'bob' }] });
});

fastify.listen({ port: 3000 });

These approaches ensure that authentication is evaluated within Fiber, reducing the risk of smuggling due to header interpretation differences. Combine this with consistent proxy configuration and regular scans using middleBrick to detect any remaining inconsistencies in authentication enforcement.