GuardAPI Logo
GuardAPI
Automated Security Protocol

How to fix Shadow API Exposure
in Plug

Executive Summary

Shadow APIs in Elixir/Plug ecosystems typically manifest when developers use the 'forward' macro to link sub-routers without enforcing a global authentication pipeline. This creates 'dark' endpoints that bypass security headers, rate limiting, and authorization checks, leaving internal logic exposed to anyone who can guess the path suffix.

The Vulnerable Pattern

VULNERABLE CODE
defmodule MyApp.Router do
  use Plug.Router
  plug :match
  plug :dispatch

VULNERABILITY: This sub-router is forwarded without any prior authentication.


Attackers can reach internal management functions by hitting /api/v1/internal/debug


forward “/api/v1/internal”, to: MyApp.InternalRouter


match _ do
send_resp(conn, 404, “Not Found”)
end
end

The Secure Implementation

The fix involves two layers of defense: 1. Strict Pipeline Enforcement: Never use 'forward' to a module that doesn't share the main application's security context. 2. Explicit Deny: Ensure that sub-routers (the 'shadow' targets) implement their own local auth plugs so they cannot be invoked in isolation during testing or via misconfigured routing logic. Use 'Plug.Conn.halt/1' to prevent execution fall-through.

SECURE CODE
defmodule MyApp.Router do
  use Plug.Router
  plug :match
  plug :dispatch

SECURE: Sub-routers must be guarded by an explicit authentication plug.


We also use a ‘halt’ strategy to ensure no unauthenticated request proceeds.


forward “/api/v1/internal”,
to: MyApp.InternalRouter,
init_opts: [],
guards: [plug: :ensure_authenticated]


defp ensure_authenticated(conn, _opts) do
case get_req_header(conn, “x-api-key”) do
[“secret_key”] -> conn
_ -> conn |> send_resp(403, “Forbidden”) |> halt()
end
end
end


defmodule MyApp.InternalRouter do
use Plug.Router


Redundant but safe: Re-verify auth at the sub-router level


plug :ensure_authenticated
plug :match
plug :dispatch


… internal routes …


end

System Alert • ID: 7965
Target: Plug API
Potential Vulnerability

Your Plug API might be exposed to Shadow API Exposure

74% of Plug apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.

RUN FREE SECURITY DIAGNOSTIC
GuardLabs Engine: ONLINE

Free Tier • No Credit Card • Instant Report

Verified by Ghost Labs Security Team

This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.

About GuardLabs → Follow us on X