Api Key Exposure in Feathersjs (Javascript)

FeathersJS is a JavaScript framework for real-time applications that often exposes REST and WebSocket endpoints. When API keys are handled in JavaScript files without proper safeguards, they can be exposed to unauthenticated clients through service configuration, hook misuse, or insecure transport. Because Feathers services run in Node.js and are typically bundled for the browser or proxied through servers, any key embedded in client-side code, service files, or hooks can be read by an attacker who inspects network traffic or source maps.

A common pattern is storing third-party service keys in Feathers service files or configuration objects that are inadvertently serialized and sent to the client. For example, a service that forwards requests to an external payment or messaging provider may include the key in the service handler or as part of the connection parameters passed to the client-side channel. If the service does not enforce server-side-only handling, the key becomes reachable through unauthenticated API calls or WebSocket events.

Additionally, misconfigured hooks that merge client payloads into external requests can leak keys when debug logging is enabled or when responses include stack traces that reference key variables. In JavaScript, the dynamic nature of objects means that if a key is attached to the app or service instance and then exposed via a get method or event, it can be enumerated by an attacker. Transport-layer weaknesses such as missing HTTPS or weak TLS configurations further increase the risk of interception.

Consider a Feathers service that calls an external email provider using an API key stored in a module-level variable. If the service method returns the full settings object to the client, the key is exposed. An attacker can use unauthenticated endpoints or WebSocket channels to trigger the service and capture the key from the response, enabling them to abuse the external provider or pivot to other systems.

OpenAPI/Swagger analysis can highlight discrepancies between declared server-side behavior and runtime endpoints, but it cannot detect whether keys are embedded in JavaScript logic. This is why active scanning with a tool that performs black-box testing and LLM-specific security probes is valuable: it can detect whether unauthenticated endpoints return sensitive configuration data or whether debug responses expose stack traces containing key material.

To prevent API key exposure in FeathersJS with JavaScript, keep all secrets on the server and never include them in client-facing service methods or hooks. Use environment variables and ensure that only necessary data is returned to the client. Validate and sanitize all inputs in hooks to avoid accidental leakage through error messages or logs.

Secure service implementation

Define your service so that external calls use server-side configuration, and the client only receives safe, filtered data. For example, store the API key in an environment variable and reference it within the service handler without returning it.

// src/services/external-api/external-api.service.js
const { ExternalProvider } = require('../external-provider');

class ExternalApiService {
  constructor(options) {
    this.options = options || {};
  }

  async find(params) {
    const apiKey = process.env.EXTERNAL_API_KEY;
    if (!apiKey) {
      throw new Error('External API key is not configured');
    }

    const provider = new ExternalProvider({ apiKey });
    // Perform server-side request; do not include apiKey in params or result
    const data = await provider.query(params.query);

    // Return only safe, filtered data to the client
    return data.map(item => ({
      id: item.id,
      name: item.name,
      // Do not include key or internal fields
    }));
  }

  // Other methods: get, create, update, patch, remove
}

module.exports = function (app) {
  const options = {
    name: 'external-api',
    // Common service options
  };
  app.use('/external-api', new ExternalApiService(options));
};

Protect hooks and avoid key leakage

Use hooks to sanitize inputs and ensure that sensitive values are not passed to external calls or logged. Avoid merging raw client data into external requests without validation.

// src/hooks/validate-api-key.hooks.js
const validateApiKey = context => {
  const { data } = context;
  if (data && data.key) {
    // Reject client-provided keys; use server-side keys only
    throw new Error('Providing an API key is not allowed');
  }
  return context;
};

module.exports = {
  before: {
    all: [],
    find: [],
    get: [],
    create: [validateApiKey],
    update: [validateApiKey],
    patch: [validateApiKey],
    remove: [validateApiKey]
  },
  after: {
    all: [],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: []
  },
  error: {
    all: [],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: []
  }
};

Environment and transport hardening

Ensure that the application enforces HTTPS and that environment variables are injected securely at runtime. In production, avoid exposing stack traces or debug details that could reveal key names or values.

// src/app.js
const feathers = require('@feathersjs/feathers');
const rest = require('@feathersjs/rest');
const socketio = require('@feathersjs/socketio');

const app = feathers();

// Enable secure transport and parsers
app.configure(rest());
app.configure(socketio());

// Use secure headers and avoid debug mode in production
if (process.env.NODE_ENV === 'production') {
  app.set('trust proxy', 1);
  // Additional hardening as needed
}

// Service registration as shown above

module.exports = app;

By following these patterns, you reduce the risk of API key exposure in FeathersJS applications written in JavaScript. The key principles are: never send secrets to the client, store keys in environment variables, validate all inputs in hooks, and return only minimal, safe data structures.