Api Key Exposure in Feathersjs with Api Keys

FeathersJS is a framework for creating JavaScript and TypeScript APIs. When developers use Api Keys in FeathersJS, they typically add them as custom headers or query parameters to authenticate service-to-service or client-to-server requests. If these keys are handled in application code that is also exposed as an API endpoint, or if they are logged, echoed back in responses, or transmitted over non-encrypted channels, they can be inadvertently exposed.

Consider a FeathersJS service that accepts an Api Key via a custom header x-api-key. If the service returns the received header value in error messages, logs, or even in a debug payload, the key can leak to unauthorized parties. This commonly occurs when developers inadvertently include the key in response bodies, stack traces, or server logs that are themselves exposed via another endpoint or monitoring system.

Another exposure vector arises from service-to-service communication. A FeathersJS app might call another internal service using an Api Key stored in environment variables. If those keys are accidentally serialized into client-facing responses, included in frontend bundles, or passed through insecure redirects, they can be harvested by attackers. Because FeathersJS allows rapid creation of services with minimal configuration, it is easy to set up endpoints that propagate keys without proper validation or redaction.

Middleware configuration also plays a role. If custom hooks or global handlers reflect request headers into responses or logs without filtering sensitive fields, Api Keys can appear in places they should not. For example, an unguarded hook might log entire headers for debugging, placing keys in plaintext in log stores that may be accessible to multiple teams or systems.

Additionally, if an OpenAPI spec generated or consumed by FeathersJS includes examples with hardcoded Api Keys, those keys can propagate into documentation, client SDKs, or shared repositories. Even when runtime behavior is secure, artifacts produced during development — such as generated clients or mock servers — may retain the keys in plaintext, creating long-term exposure risks.

Because middleBrick tests unauthenticated attack surfaces and scans OpenAPI specs with full $ref resolution, it can detect whether Api Key patterns appear in responses, error objects, or documentation artifacts. This helps identify inadvertent exposure that often slips through routine code review.

To reduce Api Key exposure in FeathersJS, apply strict handling and redaction practices in both service logic and middleware. The goal is to ensure keys are used for authentication but never reflected, logged, or serialized in a way that reaches downstream consumers.

First, avoid echoing headers in responses. Instead of returning the raw key, use a constant-time comparison and discard it immediately after validation:

// Safe FeathersJS hook example
const authenticateApiKey = context => {
  const { app } = context;
  const provided = context.headers['x-api-key'];
  const expected = process.env.API_KEY;

  if (!provided || provided !== expected) {
    throw new Error('Not authorized');
  };

  // Do not attach the key to the context or response
  // context.params.headers = { ...context.params.headers, 'x-api-key': undefined };
  return context;
};

export default authenticateApiKey;

Second, sanitize logs and error objects. Never include headers in logs verbatim. Create a redaction helper and apply it in a global hook:

// Redaction hook for FeathersJS
const redactSensitive = context => {
  const safeParams = { ...context.params };
  if (safeParams.headers) {
    safeParams.headers = { ...safeParams.headers };
    if (safeParams.headers['x-api-key']) {
      safeParams.headers['x-api-key'] = '[REDACTED]';
    }
  }
  context.params = safeParams;
  return context;
};

export default redactSensitive;

Third, ensure transport security. Enforce HTTPS across all services and Hooks to prevent interception. In production configurations, terminate TLS at the load balancer or reverse proxy and make sure FeathersJS only listens on localhost when behind a proxy.

Fourth, audit generated artifacts. If you use OpenAPI generation or client SDK creation, scan the outputs for hardcoded keys. Use tools or scripts that strip examples containing realistic key patterns before publishing specs or SDKs. middleBrick can flag the presence of Api Key patterns in specs and runtime responses, helping you catch accidental inclusion before deployment.

Fifth, apply principle of least privilege and scoped keys. Instead of using a single long-lived key, create short-lived or scoped keys for specific operations. Rotate keys regularly and monitor usage. With middleBrick Pro continuous monitoring, you can schedule scans of your FeathersJS endpoints and receive alerts if new exposure patterns appear.

Finally, integrate checks into CI/CD. Using the middleBrick GitHub Action, you can fail builds when Api Key patterns are detected in code or generated documentation, preventing regressions. For local development and debugging, the middleBrick CLI allows you to scan individual endpoints quickly and review JSON output for sensitive data leaks.