Time Of Check Time Of Use in Echo Go with Bearer Tokens

Time Of Check Time Of Use (TOCTOU) arises when the outcome of a security decision (the check) does not hold at the point of use. In Echo Go, a common pattern is to validate a Bearer token early in the request lifecycle—often via middleware that verifies the token’s presence and claims—and then rely on that decision later in route handlers. If the authorization check does not revalidate the token immediately before performing the sensitive action, an attacker can exploit timing windows or mutable state to bypass intended access controls.

Consider an Echo Go service that uses JWT Bearer tokens. A typical middleware might decode and validate the token, attach claims to the context, and then allow the request to proceed. The vulnerability occurs when the handler performs additional authorization checks by reading the cached claims in the context without rechecking token validity, revocation, or scope changes that could have occurred between the initial verification and the use of the claims. For example, if the token is a reference token that can be revoked on the server, the middleware may mark the request as authenticated, but the handler assumes the token remains valid when accessing sensitive resources. An attacker who can cause token invalidation or who exploits race conditions may find that the check and use are not synchronized, effectively bypassing authorization.

Another TOCTOU scenario with Bearer tokens in Echo Go involves rate limiting or quota checks that are performed before token validation, while the actual resource access occurs after. If the token validation step is deferred or skipped due to an earlier positive check, an unauthenticated request might reach the handler because the token was not properly verified at the point of use. This is particularly relevant when using asymmetric keys: the middleware might verify the signature once, but if the public key is rotated or the token is blacklisted between checks, the handler must not trust the cached authentication state without revalidating the token against the current key material and revocation lists.

Echo Go applications that expose unauthenticated LLM endpoints or use excessive agency patterns with function calls increase the risk surface. If an LLM endpoint is reachable without a token, or if function call handlers rely on prior context without rechecking Bearer token validity, TOCTOU can allow unintended access to model endpoints or tool calls. Real-world attack patterns such as CVE-2020-28167-style authorization bypasses can manifest when developers assume a single check is sufficient across multiple execution stages. Proper mitigation requires validating Bearer tokens at each stage where authorization decisions are made, ensuring that the token’s claims, scope, and revocation status are verified immediately before accessing protected resources.

To prevent TOCTOU with Bearer tokens in Echo Go, ensure that token validation and authorization checks occur immediately before the sensitive operation, and avoid relying on stale context state. Use middleware to validate the token on each request and attach only verified, minimal claims to the context. Then, in handlers that perform sensitive actions, revalidate the token or at least recheck critical claims such as scope, roles, or revocation status.

Below is a concrete, secure code example for Echo Go that demonstrates proper Bearer token handling to mitigate TOCTOU. This example uses JWT validation with immediate verification on each request and rechecks essential claims within the handler before proceeding.

package main

import (
    "context"
    "net/http"
    "strings"

    "github.com/labstack/echo/v4"
    "github.com/labstack/echo/v4/middleware"
    "github.com/golang-jwt/jwt/v5"
)

// SecureMiddleware validates Bearer tokens on every request and attaches verified claims.
func SecureMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
    return func(c echo.Context) error {
        auth := c.Request().Header.Get("Authorization")
        if auth == "" {
            return echo.NewHTTPError(http.StatusUnauthorized, "missing authorization header")
        }
        parts := strings.Split(auth, " ")
        if len(parts) != 2 || parts[0] != "Bearer" {
            return echo.NewHTTPError(http.StatusUnauthorized, "invalid authorization format")
        }
        tokenString := parts[1]

        token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
            // TODO: use appropriate key management, e.g., JWKS or local key
            return []byte("your-secret-key"), nil
        })
        if err != nil || !token.Valid {
            return echo.NewHTTPError(http.StatusUnauthorized, "invalid token")
        }

        claims, ok := token.Claims.(jwt.MapClaims)
        if !ok || !token.Valid {
            return echo.NewHTTPError(http.StatusUnauthorized, "invalid claims")
        }

        // Attach verified claims to context for downstream use.
        c.Set("claims", claims)
        return next(c)
    }
}

// SensitiveHandler revalidates critical claims before using them.
func SensitiveHandler(c echo.Context) error {
    claims, ok := c.Get("claims").(jwt.MapClaims)
    if !ok {
        return echo.NewHTTPError(http.StatusForbidden, "missing claims")
    }

    // Immediate recheck of scope or roles immediately before resource access.
    scope, ok := claims["scope"].(string)
    if !ok || scope != "admin" {
        return echo.NewHTTPError(http.StatusForbidden, "insufficient scope")
    }

    // Perform the sensitive action only after revalidation.
    return c.JSON(http.StatusOK, map[string]string{"status": "authorized"})
}

func main() {
    e := echo.New()
    e.Use(SecureMiddleware)
    e.GET("/admin", SensitiveHandler)
    e.Start(":8080")
}

Key points to prevent TOCTOU:

• Validate Bearer tokens in middleware on every request and avoid caching authorization decisions across asynchronous boundaries.
• In handlers that access protected resources, recheck claims such as scope, roles, or tenant context immediately before the operation.
• For reference tokens or token revocation, integrate a revocation check (e.g., introspection or denylist lookup) at the point of use rather than relying on cached validity.
• If exposing unauthenticated LLM endpoints, enforce strict token validation before allowing model calls, and avoid propagating unverified context to function call handlers.

By ensuring that each authorization decision revalidates the Bearer token and its claims immediately before use, you eliminate the timing gap that enables TOCTOU attacks in Echo Go services.