Token Leakage in Fiber with Hmac Signatures

Token leakage occurs when authentication tokens or session identifiers are unintentionally exposed in logs, URLs, or error messages. In Fiber, using Hmac Signatures for request authentication can inadvertently expose tokens when developers embed tokens in query parameters or headers that are later logged or reflected. Because Hmac Signatures typically rely on a shared secret and a deterministic hash of the request components, any token that travels in an unprotected part of the request becomes reachable if an endpoint reflects that input or logs raw query strings.

For example, if a Fiber route reads a token from a query parameter and passes it into the signature base string, an attacker who can cause the server to log or echo that parameter may obtain the token. Additionally, if the Hmac verification logic is implemented in a way that leaks the raw token through error messages (e.g., signature mismatch details that include the received token), the confidentiality of the token is compromised. This is especially risky when endpoints also expose OpenAPI/Swagger specs without filtering sensitive parameters, because the spec may implicitly document the token’s presence in URLs.

During a black-box scan, middleBrick tests inputs that reach endpoints and checks whether tokens appear in responses, logs, or error payloads. It also cross-references the OpenAPI specification to see whether parameters marked as sensitive are reflected in paths or query strings. Since the scan runs unauthenticated and tests the active attack surface, it can identify endpoints where token leakage is plausible via Hmac Signatures usage. The LLM/AI Security checks further probe whether system prompt formats or error handling might inadvertently surface token-like values in model outputs or logs.

To mitigate this class of issue, ensure tokens never enter the query string or response-reachable headers when Hmac Signatures are used. Instead, transmit tokens only in HTTP-only, Secure cookies or in the Authorization header using a bearer scheme, and ensure the Hmac base string excludes sensitive token values that should remain opaque. Validate and sanitize all inputs that participate in signature generation, and avoid including raw tokens in logs or error details. middleBrick’s findings include prioritized guidance on how to isolate token handling from the signature computation and how to structure requests so that sensitive values are not reflected in any part of the observable API surface.

Remediation focuses on ensuring tokens are not part of the data used to compute or verify Hmac Signatures and that tokens are transmitted over strictly controlled channels. The following examples show a secure pattern in Fiber where the token is conveyed via an Authorization header and excluded from the signature base string.

import { App, Context } from 'https://deno.land/x/fiber@v2.0.0/mod.ts';

const app = new App();

// Middleware to extract token and compute/verify Hmac without exposing it
app.use((ctx: Context, next: () => Promise) => {
  const auth = ctx.request.header('Authorization');
  if (!auth || !auth.startsWith('Bearer ')) {
    ctx.throw(401, 'Authorization header missing');
  }
  const token = auth.slice(7); // Remove 'Bearer '
  // Store token securely for downstream use; do not include it in signature base
  ctx.set('x-auth-token', token);
  return next();
});

// Example endpoint that validates Hmac signature, excluding the token from the signed payload
app.post('/webhook', (ctx: Context) => {
  const signatureHeader = ctx.request.header('X-Hub-Signature-256');
  const token = ctx.get('x-auth-token');
  const body = ctx.request.body({ type: 'json' });
  const payload = JSON.stringify(body.value);
  const secret = Deno.env.get('HMAC_SECRET');
  if (!secret) {
    ctx.throw(500, 'Server misconfiguration: missing secret');
  }
  const expected = 'sha256=' + crypto.subtle.sign('HMAC', secret, new TextEncoder().encode(payload));
    // Note: In practice, use a well-audited Hmac utility to compare signatures in constant time
  if (signatureHeader !== expected) {
    ctx.throw(401, 'Invalid signature');
  }
  // Token is available for business logic but not part of the signed string
  ctx.body = { received: true, tokenPresent: !!token };
});

Key points in the remediation:

• Extract the token from the Authorization header and avoid reading it from query parameters or the request path.
• Do not include the raw token value in the string that is signed; sign only the necessary, non-sensitive parts of the request (e.g., selected headers and the body).
• Use constant-time comparison for Hmac verification to prevent timing attacks.
• Ensure error messages do not echo the token or include details that could aid an attacker in correlating tokens with signatures.
• Leverage middleware to centralize token extraction and validation so that all endpoints consistently handle the token and the Hmac verification logic.

When using OpenAPI specifications, mark token parameters as sensitive and avoid reflecting them in paths or examples. middleBrick’s CLI can scan your Fiber project and highlight endpoints where tokens appear in query strings or where Hmac bases include potentially sensitive inputs, helping you align implementation with best practices.