Distributed Denial Of Service in Adonisjs with Jwt Tokens

AdonisJS is a Node.js web framework that commonly uses JSON Web Tokens (JWT) for stateless authentication. When JWT is used without complementary protections, certain DoS vectors can manifest in API endpoints that rely on token parsing and validation. A distributed denial of service in this context does not require a distributed botnet to be impactful; a single attacker can craft requests that trigger disproportionate server-side work, exhausting CPU, memory, or event loop capacity.

One specific risk is expensive or unbounded JWT verification work. If an endpoint accepts a JWT and performs synchronous, repeated cryptographic verification for every request without caching or rate-limiting, an attacker can send many requests with valid but high-CPU-cost tokens (e.g., tokens signed with strong asymmetric keys or with large payloads). Another vector is token validation bypass via malformed tokens that cause repeated parsing failures or exceptions, leading to unhandled promise rejections or stack traces that degrade performance.

Additionally, if the application decodes or verifies JWTs on each request and also performs resource-intensive operations (like database lookups or file reads) based on token claims without guardrails, an attacker can amplify load by sending tokens that trigger heavy logic. For example, an endpoint that queries a relational database for user permissions on every request, keyed by JWT subject, can suffer from N+1 query patterns when token replay or enumeration occurs. Misconfigured secret or key rotation can also cause repeated fallback or re-validation paths that increase latency.

Because middleBrick scans the unauthenticated attack surface and checks Rate Limiting and Input Validation in parallel, it can surface these risks by identifying missing rate controls and weak input checks around token handling. Findings may highlight missing cost-throttling on token parsing, lack of request caps per identity, or absence of circuit-breaker patterns that would mitigate abuse before it impacts availability.

Remediation focuses on reducing per-request CPU cost, bounding work, and ensuring malformed tokens fail fast. Use standardized, well-audited libraries and avoid custom crypto. Below are concrete, realistic examples for AdonisJS.

1. Use asynchronous verification and cache validated tokens

Verify JWTs asynchronously and cache successful validation results for a short TTL to avoid repeated crypto operations. This reduces CPU load under token replay or enumeration attacks.

import { verify } from 'jsonwebtoken'
import { Cache } from '@ioc:Adonis/Core/Cache'

export async function validateToken(token: string): Promise {
  const cacheKey = `jwt:verification:${token}`
  const cached = await Cache.get(cacheKey)
  if (cached) return cached

  // Use async verify with a public key or secret
  const decoded = await verify(token, process.env.JWT_PUBLIC_KEY!, {
    algorithms: ['RS256'],
  })
  // Cache for a short window to prevent repeated verification of same token
  await Cache.put(cacheKey, decoded, 30) // 30 seconds
  return decoded
}

2. Enforce strict input validation and size limits

Reject tokens that exceed reasonable size limits early to prevent resource exhaustion from large payloads. Validate structure before parsing deeply nested claims.

import { schema } from '@ioc:Adonis/Core/Validator'

const tokenSchema = schema.create({
  token: schema.string({}, [rules.minLength(10), rules.maxLength(500)]),
})

export const tokenValidator = async (payload: any) => {
  const validated = await schema.compile(tokenSchema).validate(payload)
  return validated
}

3. Apply rate limiting per identity derived from JWT

Use a sliding window or token-bucket rate limiter on identifiers extracted from the JWT (e.g., sub) to limit request bursts that could indicate abuse.

import { rateLimiter } from '@ioc:Adonis/Addons/Limiter'

export const identityRateLimiter = rateLimiter({
  identifier: (ctx) => {
    const token = ctx.request.header().authorization?.replace('Bearer ', '')
    if (!token) return 'anonymous'
    try {
      const decoded = verify(token, process.env.JWT_PUBLIC_KEY!, { algorithms: ['RS256'] })
      return decoded.sub || 'anonymous'
    } catch {
      return 'invalid'
    }
  },
  limit: 100, // 100 requests per window
  duration: 60, // per 60 seconds
})

4. Fail fast on malformed tokens and avoid expensive fallbacks

Ensure token parsing errors are caught and handled with minimal work. Do not fall back to expensive re-validation paths unless necessary.

import { verify } from 'jsonwebtoken'

export function safeVerify(token: string) {
  try {
    return verify(token, process.env.JWT_PUBLIC_KEY!, { algorithms: ['RS256'] })
  } catch (error) {
    // Log minimally; avoid exposing stack traces in responses
    console.warn('JWT verification failed', { error: error.message })
    throw error
  }
}

5. Prefer stateless checks over per-request DB queries keyed by JWT claims

If permissions are required, embed necessary roles or scopes in the JWT and avoid per-request joins that can be triggered repeatedly by the same token.

// Example JWT payload includes roles
const { roles } = verify(token, publicKey, { algorithms: ['RS256'] }) as any
if (!roles.includes('admin')) {
  throw new Error('Unauthorized')
}

6. Use short-lived access tokens and refresh token rotation

Short-lived access tokens reduce the window for replay; refresh tokens should be one-time use and bound to client metadata to prevent token family abuse.

// When issuing tokens
const accessToken = sign({ sub: user.id, roles: user.roles }, accessSecret, { expiresIn: '15m' })
const refreshToken = sign({ sub: user.id, jti: uuid() }, refreshSecret, { expiresIn: '7d' })