Injection Flaws in Express with Basic Auth

Injection flaws in Express when Basic Authentication is used arise when user-controlled input is concatenated into commands or queries without proper validation or parameterization. Basic Auth transmits credentials as a base64-encoded string in the Authorization header; while the encoding is not encryption, the presence of auth does not prevent injection in request parameters, headers, or body.

Consider an endpoint that builds a command or query using values from req.query, req.body, or even custom headers. If these values are interpolated into a system command, a SQL string, or a command for an external parser, an attacker can escape intended boundaries. For example, a username taken from a header and appended into a shell command enables command injection; a user-supplied value used in a SQL string can lead to SQL injection; unsafe deserialization or evaluation can result in prototype pollution or remote code execution.

Basic Auth itself does not sanitize input. Attackers may pair stolen or guessed credentials with injection attempts to escalate impact: authenticated sessions may access more sensitive data or privileged operations, making injection outcomes more severe. Common patterns include building dynamic queries with string concatenation, using unsanitized input in eval or template literals, or passing user data to parsers that interpret control characters or markup.

Real-world examples align with known CVEs and OWASP API Top 10 categories. Injection flaws often map to A03:2021 — Injection in the OWASP API Security Top 10, and depending on the component, could relate to A01:2021 (Broken Object Level Authorization) when tainted input influences access control checks. In SSRF contexts, user input used to craft URLs can force the server to reach internal services, especially when combined with trusted credentials that allow broader probing.

middleBrick’s 12 security checks run in parallel and include Input Validation and Unsafe Consumption tests that detect dangerous concatenation patterns, excessive agency in LLM-related endpoints, and data exposure risks. These checks analyze the unauthenticated attack surface, and if an OpenAPI spec is provided, they cross-reference definitions with runtime findings to highlight mismatches between declared behavior and actual endpoints.

Remediation focuses on strict input validation, avoiding concatenation, and using safe APIs. Do not rely on the presence of Basic Auth to sanitize data; treat authenticated and unauthenticated input with the same rigor.

1. Use parameterized queries for databases

Instead of building SQL strings, use placeholders provided by your database driver. This prevents SQL injection regardless of authentication headers.

const mysql = require('mysql2/promise');

async function getUserByUsername(req, res) {
  const username = req.query.username;
  if (typeof username !== 'string' || !/^[A-Za-z0-9_]{1,64}$/.test(username)) {
    return res.status(400).json({ error: 'Invalid username format' });
  }
  const connection = await mysql.createConnection({ host: 'localhost', user: 'app', database: 'db' });
  const [rows] = await connection.execute('SELECT id, role FROM users WHERE username = ?', [username]);
  await connection.end();
  res.json(rows[0] || null);
}

2. Avoid shell command construction with user input

If you must invoke shell commands, use a strict allowlist and avoid interpolation. Prefer native APIs over spawning processes.

const { execFile } = require('child_process');

function hashPassword(req, res) {
  const password = req.body.password;
  if (typeof password !== 'string' || password.length < 8 || password.length > 128) {
    return res.status(400).json({ error: 'Invalid password' });
  }
  // Use execFile with a fixed binary and array arguments; do not build a shell string.
  execFile('sha256sum', [], { input: password }, (error, stdout) => {
    if (error) return res.status(500).json({ error: 'Hashing failed' });
    res.json({ hash: stdout.trim() });
  });
}

3. Validate and sanitize all headers and body fields

Do not trust custom headers or body fields. Normalize and validate before use. For Basic Auth, parse credentials using a library rather than manual splitting to avoid header smuggling mistakes.

const basicAuth = require('express-basic-auth');

app.use(basicAuth({
  users: { 'admin': 'supersecret' },
  challenge: true,
  authorizer: (user, password) => {
    // Perform safe comparison; do not concatenate user/password into dynamic code.
    return user === 'admin' && password === 'supersecret';
  },
  unauthorizedResponse: 'Access denied',
}));

app.get('/profile', (req, res) => {
  // At this point, express-basic-auth has already validated credentials.
  // Proceed with safe, validated business logic.
  res.json({ message: 'Authenticated profile access' });
});

4. Enforce strict Content-Type and input schema checks

Use middleware to validate JSON schemas and reject unexpected types or nested structures that could enable prototype pollution or injection.

const { body, validationResult } = require('express-validator');

app.post('/comment', [
  body('text').isString().trim().escape(),
  body('postId').isInt({ min: 1 }),
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  // Safe to use req.body.text and req.body.postId
  res.json({ received: req.body });
});

middleBrick’s CLI tool can be used in scripts to verify that such mitigations reduce findings: middlebrick scan <url>. The GitHub Action can enforce a maximum risk score in CI/CD gates, and the MCP Server allows AI coding assistants to trigger scans directly from the editor.