Password Spraying in Express with Basic Auth

Password spraying is an authentication attack that attempts a small number of common passwords across many accounts to avoid account lockouts. When Express applications use HTTP Basic Auth without protective controls, the attack surface is directly exposed because the server performs the credential check on each request.

In Express, Basic Auth is often implemented by reading the Authorization header, decoding the base64 token, and comparing the username and password against a user store or hard‑coded credentials. If the endpoint does not enforce rate limiting, account lockout, or other anti‑abuse mechanisms, an attacker can iterate passwords at the application level without triggering per‑account thresholds. Because Basic Auth sends credentials on every request, a successful spray against one account can persist across sessions until credentials are rotated.

Consider an Express route that validates credentials on each call:

const auth = require('basic-auth');
const users = {
  alice: 'Password123',
  bob: 'Winter2024!'
};

app.get('/api/me', (req, res) => {
  const credentials = auth(req);
  if (!credentials || !(credentials.name in users) || users[credentials.name] !== credentials.pass) {
    res.set('WWW-Authenticate', 'Basic realm="example"');
    return res.status(401).send('Authentication required');
  }
  res.json({ user: credentials.name });
});

If an attacker knows valid usernames (e.g., from public directories or previous breaches), they can run a password spraying campaign against /api/me. Because there is no rate limiting per IP or per user, the attacker can send many requests with different passwords in a short time. The 12 parallel security checks in middleBrick include rate limiting and authentication testing, which would flag missing controls and surface the risk of password spraying against Basic Auth endpoints.

Additionally, Basic Auth credentials are only base64-encoded, not encrypted, so they are susceptible to interception if TLS is not enforced. MiddleBrick’s encryption and data exposure checks verify that credentials are transmitted over HTTPS and that sensitive data is not inadvertently exposed in responses, logs, or error messages.

Remediation focuses on reducing the attack surface for password spraying and ensuring credentials are handled safely. Implement rate limiting, avoid leaking user existence, and enforce transport security.

• Add rate limiting to limit requests per IP and introduce small delays after failures. This reduces the feasibility of spraying passwords within short time windows.
• Use constant-time comparison to avoid timing attacks that can reveal whether a username exists.
• Do not disclose whether a username is valid; return the same generic 401 message for missing or invalid credentials.
• Enforce HTTPS to protect credentials in transit.
• Avoid hard‑coded credentials; use environment variables or a secure vault and rotate passwords regularly.

Here is a hardened Express implementation with rate limiting and safer credential handling:

const express = require('express');
const basicAuth = require('basic-auth');
const rateLimit = require('express-rate-limit');

const app = express();

// Store users with hashed passwords in production; this example uses plain text for clarity.
const users = {
  alice: 'Password123',
  bob: 'Winter2024!'
};

// Rate limit to mitigate password spraying
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 30, // limit each IP to 30 requests per windowMs
  message: 'Too many requests from this IP, please try again later.',
  standardHeaders: true,
  legacyHeaders: false,
});
app.use('/api/me', authLimiter);

app.get('/api/me', (req, res) => {
  const credentials = basicAuth(req);
  if (!credentials) {
    res.set('WWW-Authenticate', 'Basic realm="example"');
    return res.status(401).send('Authentication required');
  }

  const expectedPassword = users[credentials.name];
  const isValid = expectedPassword && timingSafeEqual(expectedPassword, credentials.pass);

  if (!isValid) {
    res.set('WWW-Authenticate', 'Basic realm="example"');
    return res.status(401).send('Authentication required');
  }

  res.json({ user: credentials.name });
});

// Constant-time comparison to mitigate timing attacks
function timingSafeEqual(a, b) {
  if (typeof a !== 'string' || typeof b !== 'string') return false;
  if (a.length !== b.length) return false;
  let result = 0;
  for (let i = 0; i < a.length; i++) {
    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return result === 0;
}

app.listen(3000, () => console.log('Server running on port 3000'));

For teams needing continuous visibility, the middleBrick Pro plan includes continuous monitoring and can integrate into CI/CD pipelines via the GitHub Action to fail builds if security scores drop below a chosen threshold. The CLI allows scanning from the terminal with middlebrick scan <url>, and the MCP Server enables scanning APIs directly from AI coding assistants within your development environment.