Fix Shadow API Exposure in Ktor
Shadow APIs are the silent killers of Ktor backends. They are undocumented, unmonitored endpoints—often legacy routes or debug tools—left exposed in production without proper authentication. If an attacker discovers these 'hidden' routes, they can bypass your entire security stack. In Ktor, this usually happens when developers define routes outside of the standard authentication pipelines or fail to implement strict visibility controls.
The Vulnerable Pattern
routing { // Standard protected route authenticate("auth-jwt") { get("/api/v1/profile") { /* ... */ } }// SHADOW API: Legacy/Debug endpoint left unprotected and undocumented // Accessible to anyone who guesses the path get("/internal/debug/user-dump") { val users = db.getAllUsersRaw() call.respond(users) }
}
The Secure Implementation
To kill shadow APIs in Ktor: 1. Use nested routing blocks to ensure no endpoint is defined outside of an `authenticate` block. 2. Implement strict RBAC (Role-Based Access Control) for internal or legacy tools, ensuring even authenticated users can't touch them unless authorized. 3. Use the Ktor OpenAPI/Swagger plugin to generate documentation directly from code; if it's not in the docs, it shouldn't be in the code. 4. Audit your routing files for 'convenience' endpoints like /debug or /test that bypass the standard security middleware.
val adminGroup = "ADMIN_ACCESS"install(Authentication) { jwt(“auth-jwt”) { /* JWT config */ } }
routing { // 1. Force all routes into an authentication scope authenticate(“auth-jwt”) { route(“/api/v1”) { get(“/profile”) { /* … */ } }
// 2. Use specific sub-routing with Role-Based Access Control (RBAC) route("/admin") { intercept(ApplicationCallPipeline.Features) { val user = call.principal<JWTPrincipal>() if (user?.payload?.getClaim("role")?.asString() != "ADMIN") { call.respond(HttpStatusCode.Forbidden) finish() } } get("/debug/user-dump") { val users = db.getAllUsersRaw() call.respond(users) } } } // 3. Explicitly block or 404 anything not defined to prevent route discovery
}
Your Ktor API
might be exposed to Shadow API Exposure
74% of Ktor apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.