Phishing Api Keys in Express with Basic Auth

Using HTTP Basic Authentication in an Express API can expose credentials when API keys are handled as usernames or passwords. Basic Auth transmits credentials in an Authorization header encoded with Base64, which is easily decoded if intercepted. If an API key is embedded in the Basic Auth username or password, and the connection is not enforced as HTTPS, an attacker on the network can capture and reuse the credentials.

Attackers may combine this weakness with phishing by sending emails that direct users to a malicious site mimicking your API endpoint. If the client mistakenly sends credentials to the attacker’s server, the attacker obtains the API key. In addition, logging mistakes can worsen the risk: if your Express app logs the full Authorization header for debugging and those logs are exposed, API keys are compromised without needing a network-level interception.

Another phishing-relevant scenario involves hosting or linking to API documentation that includes example requests with hardcoded Basic Auth credentials. If these examples are copied into client-side JavaScript or public repositories, keys can be harvested by automated scanning tools. Even without active phishing, insecure storage of credentials in client-side code is a common vector for automated credential theft.

middleBrick scans such configurations as part of its unauthenticated attack surface tests. One of the 12 parallel checks examines Data Exposure and Encryption, flagging endpoints that transmit or store credentials in reversible or weakly protected forms. The LLM/AI Security checks also look for system prompt leakage and output patterns that may inadvertently expose keys, which is relevant when API keys are mishandled in error messages or logs that are returned to callers.

For Express applications, the risk is elevated when Basic Auth is used without additional protections like rate limiting or strict transport enforcement. Without rate limiting, attackers can brute-force credentials. Without enforced HTTPS, credentials traverse the network in clear encodable form. MiddleBrick’s checks for Rate Limiting and Encryption highlight these gaps, providing prioritized findings with severity levels and remediation guidance.

To reduce phishing and interception risks, avoid embedding API keys directly as usernames or passwords in Basic Auth. Instead, use opaque tokens managed outside Basic Auth, or migrate to more secure schemes like Bearer tokens with proper validation. If you must use Basic Auth, enforce HTTPS and avoid logging authorization headers.

Example of a vulnerable Express route that uses Basic Auth with an API key as the password:

const express = require('express');
const app = express();
const auth = require('basic-auth');

app.get('/data', (req, res) => {
  const user = auth(req);
  if (!user || !validate(user.name, user.pass)) {
    res.set('WWW-Authenticate', 'Basic realm="example"');
    return res.status(401).send('Access denied');
  }
  // Dangerous: user.pass may be an API key
  res.json({ message: 'OK' });
});

function validate(username, password) {
  // Example check; do not store keys in source code
  return username === 'apiuser' && password === 'sk_live_abc123';
}

app.listen(3000);

Remediation steps:

• Enforce HTTPS in production to prevent credential interception in transit.
• Do not use API keys as passwords; use short-lived tokens or session-based authentication.
• Avoid logging the Authorization header; sanitize logs to exclude sensitive headers.
• Implement strict CORS policies to reduce the risk of credentials being used cross-origin.

More secure approach using environment-managed secrets and avoiding Basic Auth for key transmission:

const express = require('express');
const app = express();

// Use a dedicated auth middleware that validates a token in a custom header
app.use('/secure', (req, res, next) => {
  const token = req.headers['x-api-key'];
  if (!token || token !== process.env.API_TOKEN) {
    return res.status(403).send('Forbidden');
  }
  next();
});

app.get('/secure/data', (req, res) => {
  res.json({ message: 'Authenticated and safe' });
});

app.listen(3000);