How to fix Insecure API Management
in ServiceStack
Executive Summary
ServiceStack's 'API First' design is a double-edged sword. Without explicit hardening, you're leaking service metadata, exposing DTOs to unauthenticated scrapers, and leaving the door open for credential stuffing. Insecure API management in this framework usually stems from default permissive configurations, missing attribute-based access control (RBAC), and leaving the metadata discovery page active in production environments.
The Vulnerable Pattern
public class UserDataService : Service { // VULNERABLE: No [Authenticate] attribute. Publicly accessible. public object Any(GetSensitiveData request) => Db.SingleById(request.Id); } public override void Configure(Container container) { // VULNERABLE: Global wildcard CORS is a CSRF/Data-exfiltration risk. Plugins.Add(new CorsFeature());
// VULNERABLE: Metadata is enabled by default, exposing internal DTO structures to attackers. // No environment-specific checks for DebugMode.
}
The Secure Implementation
To fix insecure management, you must adopt a 'Deny-by-Default' posture. 1. Apply [Authenticate] and [RequiredRole] attributes to services to prevent unauthorized DTO execution. 2. Modify 'Config.EnableFeatures' to remove 'Feature.Metadata' in production; this blinds attackers by removing the auto-generated documentation at /metadata. 3. Lock down 'CorsFeature' by replacing wildcards with an explicit whitelist. 4. Ensure 'RequireSecureConnection' is true for your AuthProviders to prevent credential sniffing over plain HTTP.
[Authenticate] [RequiredRole("InternalAdmin")] public class UserDataService : Service { public object Any(GetSensitiveData request) => Db.SingleById(request.Id); } public override void Configure(Container container) { // SECURE: Enforce JWT/Session Auth and strict CORS Plugins.Add(new AuthFeature(() => new AuthUserSession(), new IAuthProvider[] { new JwtAuthProvider(AppSettings) { RequireSecureConnection = true } }));
Plugins.Add(new CorsFeature( allowedOrigins: "https://safe-origin.com", allowCredentials: true, allowedMethods: "GET,POST,PUT,DELETE,OPTIONS" )); // SECURE: Disable Metadata and Auto-UI in production to prevent schema discovery if (!Config.DebugMode) { Config.EnableFeatures = Feature.All.Remove(Feature.Metadata | Feature.Html | Feature.Csv); } // SECURE: Implement Global Request Throttling Plugins.Add(new RequestLogsFeature { Capacity = 1000 });
}
Your ServiceStack API
might be exposed to Insecure API Management
74% of ServiceStack apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.