Use After Free in Gin with Bearer Tokens

Use After Free (UAF) in the Gin web framework when combined with Bearer Token handling typically arises from how objects referenced by token-derived context or request-scoped values are managed across goroutines. In Gin, developers often store parsed claims or user metadata into the context using c.Set and then retrieve those values in downstream handlers or middleware. If the stored object holds a pointer to a backing buffer (for example, a byte slice derived from token parsing) and that buffer is reused or returned to a pool while a handler still holds a reference, a use-after-free condition can manifest as crashes or data corruption. This can occur when token parsing logic reuses a temporary buffer for each request, and a deferred function or background routine dereferences a pointer to that buffer after the request context is released.

Bearer token extraction in Gin is commonly implemented via middleware that reads the Authorization header, validates the token, and then attaches claims to the context. Consider a pattern where the token is parsed and the resulting claims struct is placed into the context for downstream use. If the claims struct contains fields that point into a temporary buffer that is reused across requests (for performance), and a handler finishes and returns to the middleware or server while another handler or goroutine still reads from those fields, the memory may have been reallocated, leading to unpredictable behavior. This is especially risky when integrating with libraries that manage their own memory pools or when using sync.Pool to reduce allocations without ensuring deep copies of referenced data.

The interaction with Bearer Tokens becomes pronounced when token parsing is done lazily or cached. For example, a developer might parse the token once, store a reference to a slice within the context, and then later handlers assume the backing array remains valid. If the token validation step reuses an internal buffer for each call and the stored pointer is not copied, a UAF can occur when the buffer is released. Real-world patterns that increase risk include using compact JWT parsing libraries that return slices into a reusable buffer, attaching those slices to the context, and then performing asynchronous work that reads the claims after the HTTP request has completed.

An example of unsafe usage: a middleware decodes a Bearer token and places a pointer to a claim slice into c.Set; a subsequent handler schedules a goroutine that reads the claim after the request returns to the pool. If the middleware or Gin’s internal handling recycles the memory backing the slice between the request end and the goroutine read, the scheduled read operates on freed memory. This scenario highlights the importance of ensuring that any data stored in the Gin context that originates from token parsing does not depend on buffers that may be reused or freed prematurely.

Tools like middleBrick can detect patterns that commonly precede UAF in API implementations, such as storage of pointers to request-scoped buffers and lack of isolation between concurrent request handlers. By scanning the unauthenticated attack surface and correlating runtime behavior with spec definitions, such scanners can highlight risky patterns in token handling and context usage. Developers should treat findings related to memory safety and concurrency as high severity and validate that any data placed into Gin’s context is either immutable for the request lifetime or defensively copied when shared across goroutines.

To prevent Use After Free when handling Bearer Tokens in Gin, ensure that any data derived from token claims is copied or owned by the handler rather than pointing into reusable buffers. Below is a secure middleware pattern that decodes a Bearer token, performs a deep copy of claims, and attaches the copy to the context so downstream handlers operate on independent data.

import (
    "github.com/gin-gonic/gin"
    "github.com/golang-jwt/jwt/v5"
    "net/http"
)

type ClaimsPayload struct {
    UserID   string   `json:"user_id"`
    Roles    []string `json:"roles"`
    Scope    string   `json:"scope"`
    // other fields
}

func BearerAuth() gin.HandlerFunc {
    return func(c *gin.Context) {
        auth := c.GetHeader("Authorization")
        if auth == "" {
            c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing authorization header"})
            return
        }
        const bearerPrefix = "Bearer "
        if len(auth) < len(bearerPrefix) || auth[:len(bearerPrefix)] != bearerPrefix {
            c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid authorization format"})
            return
        }
        tokenString := auth[len(bearerPrefix):]

        token, err := jwt.ParseWithClaims(tokenString, &ClaimsPayload{}, func(token *jwt.Token) (interface{}, error) {
            // TODO: replace with your keyfunc
            return []byte("your-secret-key"), nil
        })
        if err != nil || !token.Valid {
            c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
            return
        }

        if claims, ok := token.Claims.(*ClaimsPayload); ok {
            // Defensive copy: allocate new slices and strings to avoid shared buffers
            safeClaims := &ClaimsPayload{
                UserID: claims.UserID,
                Scope:  claims.Scope,
                Roles:  make([]string, len(claims.Roles)),
            }
            copy(safeClaims.Roles, claims.Roles)
            c.Set("claims", safeClaims)
        } else {
            c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"error": "invalid claims type"})
            return
        }
        c.Next()
    }
}

In this example, the token is parsed and the claims are read into a temporary ClaimsPayload. Instead of storing a pointer that may refer to reused memory, we construct a new ClaimsPayload and explicitly copy the Roles slice. This ensures that the data attached to the Gin context is owned by the request and not backed by a buffer that could be freed or reused elsewhere. Downstream handlers can safely read from c.Get("claims") without risking use-after-free.

Another common pitfall is the use of global or pooled buffers when unmarshaling token payloads. Avoid patterns that write token JSON or claims directly into a buffer from a pool and then store references to that buffer. Instead, unmarshal into freshly allocated structures or perform deep copies before storage. The following snippet illustrates an unsafe pattern and its corrected version:

// Unsafe: reuses a buffer from a sync.Pool
var bufPool = sync.Pool{
    New: func() interface{} { return new(bytes.Buffer) },
}

func unsafeMiddleware(c *gin.Context) {
    buf := bufPool.Get().(*bytes.Buffer)
    buf.Reset()
    // Simulated token processing that writes into the pooled buffer
    buf.WriteString(`{"user_id":"123","roles":["admin"]}`)
    var tempClaims ClaimsPayload
    json.NewDecoder(buf).Decode(&tempClaims)
    // Attaching a pointer that shares buf’s underlying data is risky
    c.Set("claims", &tempClaims)
    bufPool.Put(buf)
    c.Next()
    // After this middleware returns, buf may be reused and tempClaims memory corrupted
}

// Safe: avoid pooling when storing references to decoded claims
func safeMiddleware(c *gin.Context) {
    var claims ClaimsPayload
    // Decode directly into a new struct without pooling shared buffers
    if err := c.ShouldBindJSON(&claims); err != nil {
        c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "invalid body"})
        return
    }
    // Copy if necessary, especially if claims came from an external token
    safeClaims := claims // value copy; if ClaimsPayload contains slices, copy them explicitly
    safeClaims.Roles = make([]string, len(claims.Roles))
    copy(safeClaims.Roles, claims.Roles)
    c.Set("claims", &safeClaims)
    c.Next()
}

Additionally, ensure that any background jobs or deferred tasks that need claims data do not rely on pointers to context-bound structures. Pass copies or serialize the necessary fields into a message queue payload to eliminate lifetime dependencies on request-scoped memory. By combining disciplined copying, avoiding shared buffers, and validating token handling patterns, you can effectively mitigate Use After Free risks in Gin applications that use Bearer Tokens.