Timing Attack in Chi with Cockroachdb

A timing attack in the context of using the Chi router with Cockroachdb typically arises when the application performs branching logic whose execution time or memory access pattern depends on secret data, such as a user’s authentication status or a valid API key. In Chi, this often occurs in middleware or route handlers that query Cockroachdb conditionally based on request properties. Because Cockroachdb is a distributed SQL database, network latency and query planning behaviors can introduce measurable timing variations between a query that matches an index and one that performs a full table scan or returns no rows.

An attacker can craft requests that cause the server to take measurably longer when a valid credential or specific record exists, allowing inference about the data without direct access. For example, a login handler that queries Cockroachdb for a user by email and then conditionally compares a password hash only when the row exists can leak existence information through response time differences. Chi does not enforce constant-time behavior by default, so developers must ensure that any branching on database results occurs in a time-invariant manner.

Because middleBrick scans unauthenticated attack surfaces, it can detect endpoints where timing-related discrepancies might be exploited, such as endpoints that exhibit different latency under controlled inputs. The scan’s checks for Input Validation and Authentication can surface routes where database interactions are not properly isolated from timing-sensitive logic. Even though middleBrick does not fix these issues, its findings include remediation guidance that encourages developers to apply constant-time patterns and avoid branching on sensitive query outcomes.

Real-world considerations include ensuring that queries to Cockroachdb are parameterized to prevent plan cache side channels and that responses are normalized in timing characteristics. Middleware that performs early exits or conditional logic based on whether a row exists should be refactored so that all code paths execute the same sequence of operations regardless of secret data. This reduces the attack surface that an adversary can measure through repeated requests.

To mitigate timing-related risks when using Chi with Cockroachdb, ensure that database interactions do not branch on sensitive or attacker-controlled data. Use parameterized queries consistently and structure your code so that execution paths remain consistent regardless of whether a record exists.

Example of a vulnerable Chi handler that leaks existence via timing:

import (
    "context"
    "net/http"
    "github.com/go-chi/chi/v5"
    "github.com/jackc/pgx/v5/pgxpool"
)

func loginHandler(pool *pgxpool.Pool) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        var email string
        // ... read email from request
        row := pool.QueryRow(r.Context(), "SELECT password_hash, mfa_enabled FROM users WHERE email = $1", email)
        var hash string
        var mfaEnabled bool
        err := row.Scan(&hash, &mfaEnabled)
        if err != nil { // timing differs between no rows and other errors
            http.Error(w, "invalid", http.StatusUnauthorized)
            return
        }
        // time-constant comparison should be used here
        // but the early return on error already leaks via timing
        // ...
    }
}

Remediation using a constant-time style and avoiding early branching on existence:

import (
    "context"
    "crypto/subtle"
    "net/http"
    "github.com/go-chi/chi/v5"
    "github.com/jackc/pgx/v5/pgxpool"
)

func loginHandler(pool *pgxpool.Pool) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        var email string
        // ... read email from request
        var hash string
        var mfaEnabled bool
        // Always perform the query; do not branch on whether the row exists
        err := pool.QueryRow(r.Context(),
            "SELECT password_hash, mfa_enabled, false::bool AS exists_flag FROM users WHERE email = $1",
            email).Scan(&hash, &mfaEnabled, new(bool)) // read into dummy if needed
        // Use a dummy hash for non-existent users to keep timing consistent
        dummyHash := make([]byte, 64)
        storedHash := hash
        if subtle.ConstantTimeCompare([]byte(storedHash), dummyHash) == 1 {
            storedHash = dummyHash
        }
        // Continue with a constant-time comparison of credentials
        // ...
        // Always return the same status and similar response shape
        w.WriteHeader(http.StatusUnauthorized)
    }
}

When using middleBrick’s CLI to scan a Chi service that connects to Cockroachdb, you can integrate checks into your workflow by running middlebrick scan <url>. The tool’s findings for Input Validation and Authentication can guide you toward endpoints where timing characteristics should be reviewed. For teams needing continuous oversight, the Pro plan’s continuous monitoring can schedule these scans and surface deviations before they reach production, while the GitHub Action can fail builds if risk scores exceed your configured thresholds.