Fix Improper Assets Management in Chi

Improper Asset Management in Chi environments typically manifests as 'Shadow APIs'—untracked, undocumented, or internal-only endpoints (like pprof, metrics, or deprecated v1 routes) exposed to the public internet. Attackers leverage these forgotten assets to bypass security controls or leak system internals. Fixing this requires strict route grouping, middleware-based access control, and environmental awareness.

The Vulnerable Pattern

func main() {
	r := chi.NewRouter()
// VULNERABILITY: Internal debug tools and legacy routes are mounted globally
// without any authorization or network scoping.
r.Mount("/debug", middleware.Profiler())
r.Get("/internal/stats", getStatsHandler)
r.Get("/api/v1/user", legacyUserHandler)

r.Get("/api/v2/user", userHandler)
http.ListenAndServe(":8080", r)
}

The Secure Implementation

The fix implements 'Defense in Depth' for asset management. First, it uses chi.Route() to logically isolate internal assets under a specific prefix. Second, it applies a mandatory Authorization middleware (AdminOnlyAuthMiddleware) to that group, ensuring that even if the route is discovered, it cannot be accessed without credentials. Finally, for high-risk assets like pprof or metrics, the code demonstrates moving them to a secondary HTTP listener bound to 127.0.0.1, making them physically unreachable from external networks regardless of the application's routing logic.

func main() {
	r := chi.NewRouter()
// 1. Public API Group
r.Group(func(r chi.Router) {
	r.Use(middleware.Logger)
	r.Get("/api/v2/user", userHandler)
})

// 2. Restricted Internal Assets Group
r.Route("/admin", func(r chi.Router) {
	r.Use(AdminOnlyAuthMiddleware) // Enforce strict AuthN/AuthZ
	r.Mount("/debug", middleware.Profiler())
	r.Get("/stats", getStatsHandler)
})

// 3. Best Practice: Run sensitive assets on a separate, internal-only listener
go func() {
	internalMux := chi.NewRouter()
	internalMux.Get("/health", healthHandler)
	http.ListenAndServe("127.0.0.1:8081", internalMux)
}()

http.ListenAndServe(":8080", r)
}