Token Leakage in Fiber with Dynamodb

Token leakage occurs when authentication tokens, session identifiers, or API keys are inadvertently exposed to unauthorized parties. In a Fiber application that interacts with DynamoDB, this risk arises from insecure handling of tokens combined with DynamoDB access patterns that can amplify exposure.

Consider a typical setup where an API endpoint retrieves user data from DynamoDB using a token provided in request headers. If the token is passed in logs, error messages, or unencrypted responses, or if DynamoDB responses are not carefully sanitized, sensitive information can be exposed. For example, an endpoint like /user/:id might query DynamoDB with userId derived from a decoded token. If the token is missing, malformed, or contains excessive claims, and the server responds with raw DynamoDB item data, tokens or secret keys embedded in item attributes (such as cached credentials or metadata) may be returned to the client.

DynamoDB-specific factors that contribute to token leakage include:

• Inclusive Scan or Query Patterns: Queries that inadvertently return items with sensitive attributes (e.g., refreshToken, sessionSecret) can expose tokens if the response is not filtered.
• Error Handling: Misconfigured error responses might include stack traces or raw DynamoDB error details that reveal token-related information.
• Cross-Account Permissions: If IAM roles attached to the Fiber application are overly permissive, a compromised token could be used to access DynamoDB items belonging to other users or services, leading to privilege escalation.

Real-world attack patterns mirror the OWASP API Top 10 Broken Object Level Authorization (BOLA) and can be detected by middleBrick’s BOLA/IDOR checks. For instance, an attacker could manipulate the :id parameter to access another user’s DynamoDB record and observe whether tokens are present in the response. middleBrick’s Property Authorization checks help identify whether token attributes are returned without proper authorization controls.

Additionally, unauthenticated LLM endpoint detection (a unique capability of middleBrick) can reveal if an API endpoint that returns DynamoDB data also exposes LLM endpoints that might inadvertently leak tokens through model outputs. Data Exposure and Encryption checks further validate whether tokens in transit or at rest are adequately protected.

Remediation focuses on strict token handling, precise DynamoDB queries, and response sanitization in Fiber applications. Below are concrete code examples that demonstrate secure patterns.

1. Use environment variables for token configuration and avoid logging tokens:

const { Router } = require('express'); // In a Fiber-like pattern using Express for clarity
const AWS = require('aws-sdk');
const router = Router();

AWS.config.update({
  region: process.env.AWS_REGION,
  accessKeyId: processEnv.AWS_ACCESS_KEY_ID,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
});
const dynamoDb = new AWS.DynamoDB.DocumentClient();

router.get('/user/:id', async (req, res) => {
  const { id } = req.params;
  const token = req.headers.authorization?.split(' ')[1];

  if (!token) {
    return res.status(401).json({ error: 'Missing authorization token' });
  }

  try {
    const params = {
      TableName: process.env.DYNAMODB_TABLE,
      Key: { userId: id },
      // Explicitly limit attributes to avoid returning sensitive token fields
      ProjectionExpression: 'userId,username,email',
    };

    const data = await dynamoDb.get(params).promise();
    if (!data.Item) {
      return res.status(404).json({ error: 'User not found' });
    }

    // Never include token material in response
    const { refreshToken, sessionSecret, ...safeItem } = data.Item;
    res.json(safeItem);
  } catch (err) {
    // Avoid exposing stack traces or DynamoDB internals
    console.error('DynamoDB error:', err.message);
    res.status(500).json({ error: 'Internal server error' });
  }
});

module.exports = router;

2. Validate and scope token claims before querying DynamoDB:

const jwt = require('jsonwebtoken');

function validateToken(token) {
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    // Enforce scope and expiration checks
    if (!decoded.scopes || !decoded.scopes.includes('read:user')) {
      throw new Error('Insufficient scope');
    }
    if (Date.now() > decoded.exp * 1000) {
      throw new Error('Token expired');
    }
    return decoded;
  } catch (err) {
    throw new Error('Invalid token');
  }
}

router.get('/user/:id', async (req, res) => {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Bearer token required' });
  }

  const token = authHeader.slice(7);
  let payload;
  try {
    payload = validateToken(token);
  } catch {
    return res.status(401).json({ error: 'Invalid or expired token' });
  }

  const params = {
    TableName: process.env.DYNAMODB_TABLE,
    Key: { userId: req.params.id },
    FilterExpression: 'userId = :uid',
    ExpressionAttributeValues: { ':uid': payload.sub },
    ProjectionExpression: 'userId,email',
  };

  const { Item } = await dynamoDb.scan(params).promise(); // Prefer query over scan
  if (!Item) {
    return res.status(403).json({ error: 'Access denied' });
  }
  res.json(Item);
});

3. Configure DynamoDB conditional writes and avoid returning tokens in items:

const paramsPut = {
  TableName: process.env.DYNAMODB_TABLE,
  Item: {
    userId: 'user-123',
    username: 'alice',
    // Ensure token fields are not stored unnecessarily
    accessToken: undefined, // Do not store raw tokens
  },
  ConditionExpression: 'attribute_not_exists(userId)',
  ReturnValues: 'NONE',
};

dynamoDb.put(paramsPut, (err, data) => {
  if (err) {
    console.error('Conditional write failed:', err.message);
    return res.status(409).json({ error: 'Conflict or invalid data' });
  }
  res.status(201).json({ message: 'User created' });
});

These practices align with middleBrick’s checks for Input Validation, Rate Limiting, and Data Exposure. By integrating the CLI tool (middlebrick scan <url>) or the GitHub Action, you can automate detection of token leakage and ensure continuous monitoring. The MCP Server enables scanning directly from AI coding assistants to catch issues early in development.