Identification Failures in Feathersjs with Hmac Signatures

Identification failures occur when an API cannot reliably confirm the identity of the caller. In FeathersJS, this risk increases when Hmac Signatures are used for authentication but the implementation does not enforce strict per-request uniqueness and server-side verification. Hmac Signatures typically combine a shared secret with selected parts of the request—such as the HTTP method, path, timestamp, and body—to produce a cryptographic signature. If the server does not validate these elements consistently, an attacker may reuse captured signatures or manipulate parameters to impersonate another client.

In FeathersJS, a common pattern is to sign requests on the client and verify the signature on the server using a shared secret. A flawed implementation might verify only the signature format and the presence of a timestamp, but skip checks for replay risk, method mismatches, or path variations. For example, if the server accepts the same timestamp and signature for different endpoints or HTTP methods, an attacker can reuse a valid signature by changing the path or method in a replay scenario. This becomes a critical identification failure when the signature is the primary or sole proof of identity.

Real-world attack patterns that exploit this include signature replay and parameter manipulation. An attacker who observes a valid request with a timestamp within the allowed window can replay that request if the server does not enforce one-time use or strict timestamp windows (for example, a narrow window of 5 minutes). Additionally, if the signature is computed over a subset of headers or body fields that an attacker can alter without breaking the signature, identification is weakened. In the context of OWASP API Top 10, this aligns with Broken Object Level Authorization (BOLA) and Identification and Authentication Failures.

middleBrick scans unauthenticated attack surfaces and would flag such identification issues under its Authentication and BOLA/IDOR checks, providing severity ratings and remediation guidance. Note that middleBrick does not fix the implementation; it reports findings and suggests how to harden verification. For LLM-specific risks, the same misconfigurations can lead to prompt injection or system prompt leakage if API endpoints used by AI tools lack strict identification controls.

To illustrate a correct Hmac signature flow in FeathersJS, consider the following server-side hook that verifies the signature and enforces timestamp and method checks. This example uses Node.js crypto and a strict verification routine:

const crypto = require('crypto');

function verifyHmacSignature(req, secret) {
  const { timestamp, signature, method, path, body } = req.headers;
  if (!timestamp || !signature || !method || !path) {
    throw new Error('Missing required authentication headers');
  }
  // Reject old requests to prevent replay (e.g., 5-minute window)
  const now = Math.floor(Date.now() / 1000);
  const allowedSkew = 300; // 5 minutes
  if (Math.abs(now - parseInt(timestamp, 10)) > allowedSkew) {
    throw new Error('Timestamp outside allowed window');
  }
  const message = `${method.toUpperCase()}\n${path}\n${timestamp}\n${typeof body === 'string' ? body : JSON.stringify(body)}`;
  const expected = crypto.createHmac('sha256', secret).update(message).digest('hex');
  // Use timing-safe compare to avoid timing attacks
  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    throw new Error('Invalid signature');
  }
  return true;
}

// Example FeathersJS before hook
const { authenticate } = require('@feathersjs/authentication');

module.exports = function() {
  return async context => {
    const secret = process.env.HMAC_SECRET;
    if (!secret) {
      throw new Error('HMAC secret not configured');
    }
    verifyHmacSignature(context.params, secret);
    // Proceed with normal FeathersJS flow after successful verification
    return context;
  };
};

The client should construct the signature in a compatible way, ensuring method, path, timestamp, and body are included exactly as the server expects:

const crypto = require('crypto');

function buildHmacSignature(secret, method, path, body) {
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const message = `${method.toUpperCase()}\n${path}\n${timestamp}\n${typeof body === 'string' ? body : JSON.stringify(body)}`;
  const signature = crypto.createHmac('sha256', secret).update(message).digest('hex');
  return { timestamp, signature };
}

// Example usage before making a FeathersJS request
const method = 'POST';
const path = '/v1/resources';
const body = { name: 'example', value: 42 };
const { timestamp, signature } = buildHmacSignature(process.env.HMAC_SECRET, method, path, body);
// Include timestamp and signature in headers

Remediation focuses on strict verification, replay protection, and canonicalization to ensure that Hmac Signatures reliably identify the caller. In FeathersJS, implement server-side hooks that validate the signature over a consistent set of components, enforce timestamp windows, and use timing-safe comparisons. Always validate the HTTP method and path as part of the signed string, because attackers may attempt to reuse a signature across endpoints or methods.

Ensure the body used in signing is canonicalized; avoid including volatile fields like whitespace-dependent JSON serialization. On the client, use the same canonical form so the computed signature matches the server expectation. Below are concrete code examples for both server verification and client construction that align with secure identification practices.

Server-side hook to enforce method, path, timestamp, and body checks with replay protection:

const crypto = require('crypto');

function verifyHmacStrict(context, secret) {
  const headers = context.params.headers || {};
  const timestamp = headers.timestamp;
  const signature = headers.signature;
  const method = context.method.toUpperCase(); // e.g., 'get', 'create'
  const path = context.path; // Feathers path without leading slash
  const body = context.data || {};

  if (!timestamp || !signature) {
    throw new Error('Authentication failed: missing timestamp or signature');
  }

  const now = Math.floor(Date.now() / 1000);
  const windowSec = 300; // 5 minutes
  if (Math.abs(now - parseInt(timestamp, 10)) > windowSec) {
    throw new Error('Authentication failed: expired timestamp');
  }

  // Canonical body string: sort keys for objects to ensure consistency
  const canonicalBody = typeof body === 'string' ? body : JSON.stringify(body, Object.keys(body).sort());
  const message = `${method}\n/${path}\n${timestamp}\n${canonicalBody}`;
  const expected = crypto.createHmac('sha256', secret).update(message).digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    throw new Error('Authentication failed: invalid signature');
  }
  return true;
}

// FeathersJS hook
module.exports = function hmacAuthentication() {
  return async context => {
    const secret = process.env.HMAC_SECRET;
    if (!secret) {
      throw new Error('Server misconfiguration: HMAC secret missing');
    }
    verifyHmacStrict(context, secret);
    return context;
  };
};

Client-side helper to build the signature using the same canonicalization:

function buildHmacCanonical(secret, method, path, body) {
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const canonicalBody = typeof body === 'string' ? body : JSON.stringify(body, Object.keys(body).sort());
  const message = `${method.toUpperCase()}\n/${path}\n${timestamp}\n${canonicalBody}`;
  const signature = crypto.createHmac('sha256', secret).update(message).digest('hex');
  return { timestamp, signature };
}

// Usage example for a FeathersJS service call
const method = 'PATCH';
const path = 'messages/123';
const body = { status: 'read' };
const { timestamp, signature } = buildHmacCanonical(process.env.HMAC_SECRET, method, path, body);
// Set headers: { 'timestamp': timestamp, 'signature': signature }

Additional remediation steps include rotating the shared secret if compromise is suspected, enforcing HTTPS to prevent on-path tampering, and logging failed verification attempts for audit. middleBrick can highlight these gaps during scans and provide prioritized findings with severity levels and remediation guidance. For teams using the Pro plan, continuous monitoring can detect regressions in signature validation across deployments, while the GitHub Action can fail builds if risk scores degrade due to identification weaknesses.