Hallucination Attacks in Feathersjs with Jwt Tokens

A hallucination attack in a FeathersJS application that uses JWT tokens occurs when an attacker manipulates or forges token claims to gain unauthorized access to data or functionality. Because FeathersJS often relies on JWTs for stateless authentication, misconfigured token validation or insecure default settings can allow an attacker to inject or escalate privileges.

One common vector involves the subject (sub) claim. If the server trusts the sub value inside the token without cross-checking it against a trusted identity store, an attacker can forge a token with any sub (e.g., an admin ID) and the server may treat that identity as valid. FeathersJS hooks that authorize requests based solely on token payload data can therefore be tricked into acting on behalf of a different user.

Another scenario involves scope or role claims. If roles such as admin are embedded in the JWT and the server applies authorization purely from the token without re-verifying permissions against a backend policy store, an attacker who obtains or crafts a token with elevated roles can perform actions they should not be allowed to. This is especially risky when token expiration is long or not enforced, increasing the window for abuse.

FeathersJS services often define custom authentication logic. If the authentication hook does not strictly validate token signatures, issuer, audience, and expiration, or if it accepts unsigned tokens in development-like configurations, an attacker can supply a manipulated token and potentially bypass intended access controls. The framework’s flexibility can inadvertently expose endpoints when token validation is incomplete.

Additionally, if endpoints reflect token claims in responses or errors, an attacker can use crafted tokens to probe behavior and infer user roles or data relationships, aiding further privilege escalation. Without strict schema validation and consistent authorization checks across services, JWT-based authentication in FeathersJS can become a vector for hallucination-style attacks where the system generates incorrect authorization decisions.

To secure FeathersJS with JWT tokens, enforce strict token validation and avoid deriving authorization decisions solely from token claims. Always verify signature, issuer, audience, and expiration. Use a robust identity provider and bind tokens to verified user records.

Example: Secure JWT setup with explicit verification

const feathers = require('@feathersjs/feathers');
const authentication = require('@feathersjs/authentication');
const jwt = require('@feathersjs/authentication-jwt');

const app = feathers();

app.configure(authentication({
  secret: process.env.AUTH_SECRET,
  path: '/authentication',
  service: 'users',
  entity: 'user',
  multi: false
}));

app.configure(jwt({
  secret: process.env.JWT_SECRET,
  algorithms: ['HS256'],
  issuer: 'https://api.yourdomain.com',
  audience: 'https://yourfrontend.com',
  clockTolerance: 60
}));

// Enforce JWT authentication for specific services
app.use('/messages', authenticate('jwt'), createService({
  Model: MessagesModel,
  paginate: { default: 10, max: 50 }
}));

Example: Validate token claims in a custom hook

const { iff, isProvider } = require('feathers-hooks-common');

function validateTokenClaims(options) {
  return async context => {
    const { user } = context.params;
    if (!user || !user.id) {
      throw new Error('Unauthorized: missing user');
    }
    // Ensure the requesting user matches the resource owner or has valid roles
    if (context.id !== undefined && context.id !== user.id && !user.roles.includes('admin')) {
      throw new Error('Forbidden: insufficient permissions');
    }
    // Re-verify sensitive claims if needed
    if (!context.params.authToken || !context.params.authToken.verified) {
      throw new Error('Invalid token');
    }
    return context;
  };
}

app.service('messages').hooks({
  before: {
    all: [
      iff(isProvider('external'), validateTokenClaims())
    ]
  }
});

Example: Strict JWT verification options and role checks

app.configure(jwt({
  secret: process.env.JWT_SECRET,
  algorithms: ['HS256'],
  issuer: 'https://api.yourdomain.com',
  audience: 'https://yourfrontend.com',
  clockTolerance: 60,
  // Require specific claims
  requiredClaims: ['iss', 'aud', 'exp', 'sub']
}));

// Role-based authorization hook
function hasRole(role) {
  return async context => {
    const { user } = context.params;
    if (!user || !user.roles || !user.roles.includes(role)) {
      throw new Error('Forbidden: requires ' + role);
    }
    return context;
  };
}

app.service('admin').hooks({
  before: {
    all: [
      authenticate('jwt'),
      hasRole('admin')
    ]
  }
});