Man In The Middle in Adonisjs with Dynamodb

When an AdonisJS application communicates with DynamoDB over unencrypted or improperly validated channels, a Man In The Middle (MITM) can intercept and alter requests and responses. AdonisJS typically makes HTTP calls to DynamoDB via SDK clients; if these calls are not explicitly forced to use HTTPS and to validate server identity, an attacker on the same network or path can position themselves between the framework and AWS.

DynamoDB endpoints are region-specific and rely on signed AWS requests. If AdonisJS does not enforce strict TLS and skips certificate validation (e.g., via insecure HTTP agents or misconfigured fetch/request libraries), an attacker can terminate the client TLS connection and relay traffic to a malicious endpoint that mimics DynamoDB. Because the SDK may still sign requests, signature validation on the service side may pass, but the confidentiality and integrity guarantees are broken. Sensitive data such as IAM credentials in request headers, PII in query keys, or token material in request bodies can be exposed.

The combination increases risk when developers use dynamic endpoint configuration pulled from environment variables or config files that can be tampered with via path traversal or injection. For example, changing the configured AWS region or endpoint URL to point to an attacker-controlled host effectively downgrades the transport security to HTTP or to a malicious TLS certificate. AdonisJS middleware that logs request bodies for debugging might inadvertently capture credentials or tokens if encryption in transit is compromised. Since DynamoDB streams and DAX configurations can also be intercepted, the integrity of cached data and downstream consumers is at risk.

Common real-world patterns that enable this include: using HTTP instead of HTTPS in endpoint URLs, disabling TLS verification in custom HTTP clients, trusting all certificates (process.env.NODE_TLS_REJECT_UNAUTHORIZED=0), or allowing user-supplied hostnames in integration configuration without strict allowlists. These misconfigurations are detectable through runtime scans that validate encryption enforcement and certificate chains, which is why continuous scanning is recommended for APIs that integrate with managed services like DynamoDB.

Remediation focuses on enforcing TLS, validating server certificates, and ensuring signed requests are never sent over insecure channels. Below are concrete, AdonisJS-friendly code examples that integrate the AWS SDK for JavaScript v3 with DynamoDB while prioritizing transport security.

1. Enforce HTTPS and strict TLS validation

Ensure the SDK client is configured to use HTTPS and that Node.js does not bypass certificate validation. Avoid setting NODE_TLS_REJECT_UNAUTHORIZED=0 in any environment.

// config/dynamodb.js
import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
import { fromNodeProviderChain } from '@aws-sdk/credential-providers';

const client = new DynamoDBClient({
  region: process.env.AWS_REGION || 'us-east-1',
  endpoint: process.env.DYNAMODB_ENDPOINT || 'https://dynamodb.us-east-1.amazonaws.com',
  tls: true,
  requestHandler: {
    httpsAgent: new (require('https').Agent)({
      rejectUnauthorized: true,
    }),
  },
  credentials: fromNodeProviderChain(),
});

export default client;

2. Validate endpoint configuration in AdonisJS providers

Add validation in your AppProvider or a dedicated service provider to ensure the endpoint is a valid HTTPS URL and matches an approved host pattern.

// start/hooks.ts
import { ApplicationContract } from '@ioc:Adonis/Core/Application';
import { string } from '@ioc:Adonis/Core/Helpers';

export default class AppHook {
  public async onBeforeRequest() {
    const endpoint = Env.get('DYNAMODB_ENDPOINT', 'https://dynamodb.us-east-1.amazonaws.com');
    const allowedHost = 'dynamodb.';
    if (!endpoint.startsWith('https://') || !endpoint.includes(allowedHost)) {
      throw new Error('Invalid DynamoDB endpoint: must use HTTPS and an allowed host');
    }
    // Optionally verify certificate fingerprints in stricter environments
  }
}

3. Use middleware to reject insecure requests in AdonisJS

Add a request middleware that ensures outbound calls to DynamoDB are only made over verified connections. This is especially useful in long-running processes or scheduled jobs.

// start/middleware/dynamodb_https.ts
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext';
import { DynamoDBClient, GetItemCommand } from '@aws-sdk/client-dynamodb';
import { fromCognitoIdentityPool } from '@aws-sdk/credential-providers';

export class DynamoHttpsMiddleware {
  public async handle(ctx: HttpContextContract, next: () => Promise) {
    const client = new DynamoDBClient({
      region: 'us-east-1',
      endpoint: 'https://dynamodb.us-east-1.amazonaws.com',
      tls: true,
      requestHandler: {
        httpsAgent: new (require('https').Agent)({ rejectUnauthorized: true }),
      },
      credentials: fromCognitoIdentityPool({
        clientConfig: { region: 'us-east-1' },
      }),
    });

    // Example: safe getItem call
    const params = {
      TableName: 'users',
      Key: { id: { S: ctx.params.id } },
    };
    try {
      const command = new GetItemCommand(params);
      const response = await client.send(command);
      ctx.response.merge(response);
    } catch (error) {
      ctx.response.badRequest({ error: 'Failed to fetch item securely' });
    }

    await next();
  }
}

4. Disable dangerous debug and proxy misconfigurations

Ensure that debugging tools or HTTP proxies do not downgrade TLS. Avoid tools that set insecure defaults in development.

// start/app.ts
import { application } from '@adonisjs/core';
import { defineConfig } from '@adonisjs/core';

export default defineConfig({
  http: {
    allowTrustHeaders: true,
    trustProxy: false, // Avoid trusting proxies that could strip TLS
  },
  node: {
    flags: {
      'tls-min-v1': 'TLSv1.2',
      'tls-max-v1': 'TLSv1.3',
    },
  },
});

5. Use environment guards and CI checks

Add pre-start checks and CI validations to prevent insecure configurations from reaching production. This complements scanning workflows provided by tools like middleBrick.

// scripts/validate-dynamodb-endpoint.js
const endpoint = process.env.DYNAMODB_ENDPOINT;
if (!endpoint) throw new Error('DYNAMODB_ENDPOINT is required');
if (!endpoint.startsWith('https://')) throw new Error('DynamoDB endpoint must use HTTPS');
if (!endpoint.includes('amazonaws.com')) throw new Error('Endpoint must be an AWS-hosted HTTPS endpoint');
console.log('DynamoDB endpoint validation passed');