Insecure Design in Feathersjs with Basic Auth

FeathersJS is a framework for real-time APIs. When Basic Auth is used without additional protections, the design of the application can expose authentication and authorization weaknesses that map to the Insecure Design category in a middleBrick scan. Insecure Design here refers to architectural and implementation patterns that allow authentication mechanisms to be bypassed, leaked, or misapplied across the request lifecycle.

Basic Auth encodes a username and password with Base64 and sends it in the Authorization header on every request. If the API is designed to accept this header but does not enforce transport integrity or validate credentials per-request, a middleBrick scan can identify missing HTTPS enforcement, lack of credential rotation, and overly broad service roles. FeathersJS services often expose multiple transports (REST and Socket.io), and if Basic Auth is only validated at the transport entry point or applied inconsistently across services, an attacker can exploit routes or sockets where auth checks are omitted.

Another design flaw is embedding credentials in client-side code or build artifacts. Because Base64 is reversible and not encryption, transmitting credentials without TLS exposes them to interception. A middleBrick scan testing unauthenticated endpoints can detect cleartext transmission patterns and missing security headers that indicate weak transport design. Additionally, if the application uses a single shared service identity (e.g., one API key or a single database user) instead of scoped identities, the design fails to enforce least privilege, enabling horizontal privilege escalation across resources.

Middleware ordering in FeathersJS also contributes to insecure design. If authentication middleware is placed after service hooks or custom logic, requests might execute business logic before credentials are verified. A middleBrick check for Authentication and BOLA/IDOR will surface routes where endpoints respond to unauthenticated probes or where object ownership is not validated. Similarly, if error messages reveal whether a user exists or whether a token was well-formed, the design leaks enumeration information that can be chained with other flaws.

The combination of FeathersJS flexibility and Basic Auth without supplemental controls increases risk. For example, an API might accept the Authorization: Basic base64(credentials) header on REST routes but omit socket authentication or WebSocket handshake validation. A scan testing multiple transports can identify inconsistent authentication across REST and real-time channels, which is an insecure design pattern. Lack of rate limiting on authentication endpoints further enables credential brute-force attempts, a design oversight that middleBrick flags under Rate Limiting and Authentication checks.

Finally, storing credentials in environment variables without runtime validation or secret rotation is a design decision that can lead to leakage. If configuration files are included in repositories or logs, a middleBrick scan that inspects deployment artifacts can detect exposed secrets. Remediation involves enforcing TLS for all transports, validating credentials on each request, applying consistent authentication across REST and sockets, and using scoped identities with least privilege.

To address Insecure Design when using Basic Auth in FeathersJS, apply transport security, centralized authentication hooks, and per-request validation. The following code examples illustrate secure patterns that align with remediation guidance a middleBrick report would provide.

1. Enforce HTTPS and reject cleartext transport

Ensure the server only listens on HTTPS and rejects HTTP. This mitigates cleartext transmission of Base64-encoded credentials.

// server.js
const https = require('https');
const fs = require('fs');
const feathers = require('@feathersjs/feathers');
const express = require('@feathersjs/express');

const app = express(feathers());

// Configure Basic Auth middleware
app.configure(require('@feathersjs/authentication').authentication({
  secret: process.env.AUTH_SECRET,
  strategies: ['jwt'] // Use JWT for session-like behavior even with Basic inputs
}));

const credentials = {
  key: fs.readFileSync('/etc/ssl/private/server.key'),
  cert: fs.readFileSync('/etc/ssl/certs/server.crt')
};

https.createServer(credentials, app).listen(443, () => {
  console.log('HTTPS server running on port 443');
});

2. Centralized authentication hook for all transports

Define an authentication hook that runs for every request, regardless of transport. This ensures credentials are validated consistently across REST and Socket.io.

// src/hooks/authentication.js
const { AuthenticationService, expressAuthentication } = require('@feathersjs/authentication');
const { iff, isProvider } = require('@feathersjs/hooks-common');

class CustomAuthenticationService extends AuthenticationService {
  async getPayload(user, params) {
    // Ensure payload includes scoped roles and does not leak sensitive data
    return { userId: user._id, roles: user.roles || [] };
  }
}

module.exports = function () {
  this.app.set('authentication', new CustomAuthenticationService(this.app));

  this.app.hooks({
    before: {
      all: [iff(isProvider('external'), expressAuthentication())],
      services: []
    },
    after: {
      all: []
    },
    error: {
      all: []
    }
  });
};

3. Validate credentials per-request and avoid shared identities

Do not rely on a single shared user. Implement a hook that verifies the Basic identity and enforces scoped permissions. Never accept credentials from client-side code.

// src/hooks/basic-auth-validate.js
const basicAuth = require('basic-auth');
const { Forbidden } = require('@feathersjs/errors');

module.exports = function () {
  return async context => {
    if (context.params.provider !== 'external') return context;

    const credentials = basicAuth(context.req);
    if (!credentials) {
      throw new Forbidden('Authentication required', { authentication: { challenges: ['Basic'] } });
    }

    // Validate credentials against a scoped user store
    const user = await context.app.service('users').get(credentials.name);
    if (!user || user.password !== credentials.pass) {
      throw new Forbidden('Invalid credentials', { authentication: { challenges: ['Basic'] } });
    }

    // Attach a scoped identity to the context
    context.params.user = { id: user._id, roles: user.roles };
    return context;
  };
};

4. Apply role-based checks in services and mixins

Ensure each service validates object ownership and role permissions, preventing BOLA even when authentication passes.

// src/services/messages/messages.hooks.js
const { iff, isProvider, preventChanges } = require('@feathersjs/hooks-common');

module.exports = {
  before: {
    all: [],
    find: [],
    get: [iff(isProvider('external'), preventChanges(['query', 'data'])]),
    create: [],
    update: [iff(isProvider('external'), preventChanges(['query', 'data'])]),
    patch: [iff(isProvider('external'), preventChanges(['query', 'data'])]),
    remove: []
  },
  after: {
    all: [],
    find: [],
    get: [async context => {
      const { user } = context.params;
      const record = context.result;
      if (record.userId !== user.id) {
        throw new Forbidden('Not allowed');
      }
    }],
    create: [],
    update: [],
    patch: [],
    remove: []
  },
  error: {
    all: [],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: []
  }
};

5. Middleware ordering: authenticate before business logic

In FeathersJS, the order of hooks and middleware determines when authentication occurs. Place authentication before any service method that accesses user-specific data.

// src/app.js
app.configure(authentication(initConfig));
app.use('/messages', messagesService);
app.use('/profile', profileService);

// Ensure authentication hook runs before service routes
app.hooks({
  before: {
    all: [app.hooks.authentication()],
    messages: [],
    profile: []
  }
});

6. Mitigate enumeration and error leakage

Standardize error responses so that authentication failures do not reveal whether a username exists. Use a generic 401/403 response for all credential failures.

// src/hooks/standard-errors.js
module.exports = function () {
  this.app.hooks.error = (err, context) => {
    if (err.name === 'NotAuthenticated' || err.name === 'Forbidden') {
      // Return a generic message to avoid user enumeration
      return new Error('Invalid request');
    }
    return err;
  };
};

By combining HTTPS enforcement, centralized per-request validation, scoped identities, and consistent error handling, the design shifts from insecure to resilient. A middleBrick scan following these changes should show improved Authentication and BOLA scores, with findings focused on configuration rather than fundamental protocol weaknesses.