Denial Of Service with Basic Auth

Detecting DoS vulnerabilities in Basic Auth requires examining both the authentication implementation and the surrounding infrastructure. Here's how to identify these issues:

Authentication Endpoint Analysis should verify that authentication handlers don't create unnecessary state. Look for patterns where failed authentication still allocates resources:

// Vulnerable pattern - creates user object even for failed auth
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  const user = db.findUser(username);
  
  if (!user || user.password !== password) {
    req.user = null; // Still created user object
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  
  req.user = user;
  res.json({ token: generateToken(user) });
});

Rate Limiting Verification is critical. Basic Auth endpoints often lack proper rate limiting because developers assume the authentication itself provides protection. Check if your API implements:

const rateLimit = require('express-rate-limit');

// Must rate limit at authentication endpoint
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // limit each IP to 5 requests per windowMs
  message: 'Too many authentication attempts'
});

app.post('/login', authLimiter, (req, res) => {
  // Authentication logic
});

Resource Usage Monitoring during authentication attempts reveals vulnerabilities. Use tools like ab (Apache Bench) or hey to simulate attack conditions:

# Test authentication endpoint with 1000 requests
hey -n 1000 -c 100 http://api.example.com/protected

Monitor CPU, memory, and response times. A vulnerable Basic Auth endpoint will show:

• Linear increase in response time as request volume increases
• Memory usage growing proportionally to request count
• CPU utilization spiking during authentication attempts

middleBrick API Security Scanning automatically detects these DoS patterns in Basic Auth implementations. The scanner tests authentication endpoints with varying request rates and analyzes response characteristics to identify amplification factors and resource exhaustion patterns.

Securing Basic Auth against DoS attacks requires architectural changes and defensive coding patterns. Here are specific remediation strategies:

Implement Request Throttling at the Network Layer before authentication even occurs:

// Express middleware for pre-authentication throttling
function basicAuthThrottle(req, res, next) {
  const clientIP = req.ip;
  const now = Date.now();
  
  // Store request timestamps in memory or cache
  const requests = throttleStore.get(clientIP) || [];
  const recentRequests = requests.filter(ts => now - ts < 60000);
  
  if (recentRequests.length > 10) {
    return res.status(429).json({ 
      error: 'Rate limit exceeded - too many auth attempts' 
    });
  }
  
  recentRequests.push(now);
  throttleStore.set(clientIP, recentRequests);
  next();
}

Optimize Authentication Workflows to minimize resource consumption:

const crypto = require('crypto');

// Fast-path for obviously invalid credentials
function quickReject(username, password) {
  // Check for common attack patterns
  if (password.length > 100 || password.includes(' ')) {
    return true;
  }
  
  // Check if username exists before expensive operations
  if (!userCache.has(username)) {
    return true;
  }
  
  return false;
}

function authenticate(username, password) {
  if (quickReject(username, password)) {
    return null;
  }
  
  const user = userCache.get(username);
  if (!user) return null;
  
  // Use constant-time comparison to prevent timing attacks
  const valid = crypto.timingSafeEqual(
    Buffer.from(password),
    Buffer.from(user.password)
  );
  
  return valid ? user : null;
}

Implement Account Lockout Mechanisms with exponential backoff:

const accountLocks = new Map();

function checkAccountLock(username) {
  const lockInfo = accountLocks.get(username);
  if (!lockInfo) return false;
  
  const { until, attempts } = lockInfo;
  if (Date.now() < until) {
    return true;
  }
  
  // Reset after lock expires
  if (attempts >= 5) {
    accountLocks.delete(username);
  }
  
  return false;
}

function recordFailedAttempt(username) {
  const lockInfo = accountLocks.get(username) || { attempts: 0 };
  lockInfo.attempts++;
  
  if (lockInfo.attempts >= 5) {
    // Exponential backoff: 1min, 5min, 15min, 1hour
    const multipliers = [1, 5, 15, 60];
    const multiplier = multipliers[Math.min(lockInfo.attempts - 5, 3)];
    lockInfo.until = Date.now() + (multiplier * 60 * 1000);
  }
  
  accountLocks.set(username, lockInfo);
}

Deploy Rate Limiting with Authentication-Aware Rules using middleware that distinguishes between authentication and regular API usage:

const rateLimit = require('express-rate-limit');

// Separate limits for auth vs regular API
const authRateLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 10, // 10 auth attempts per 15 minutes
  message: 'Too many authentication attempts',
  skip: (req) => !req.headers.authorization
});

const apiRateLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100, // 100 API requests per 15 minutes
  message: 'Too many requests',
  skip: (req) => req.headers.authorization
});

app.use('/api/protected/*', apiRateLimiter);
app.use('/api/auth/*', authRateLimiter);

Monitor and Alert on Authentication Patterns to detect ongoing attacks:

const winston = require('winston');

const authLogger = winston.createLogger({
  transports: [
    new winston.transports.File({ filename: 'auth.log' })
  ]
});

function logAuthAttempt(username, success, ip) {
  authLogger.info(`Auth attempt: ${success ? 'SUCCESS' : 'FAIL'}`, {
    username,
    ip,
    timestamp: new Date().toISOString()
  });
  
  // Alert on suspicious patterns
  if (!success && shouldAlert(username, ip)) {
    alertAdmin(`Suspicious auth attempts from ${ip} for user ${username}`);
  }
}