Api Key Exposure in Sails with Hmac Signatures

In Sails applications, using HMAC signatures for request authentication can inadvertently expose API keys when implementation details are mishandled. HMAC relies on a shared secret key to sign requests, and if the key is embedded in client-side code, exposed in logs, or transmitted over insecure channels, it becomes a high-severity exposure. This typically occurs when developers include the key in JavaScript bundles or configuration files that are served to browsers, enabling attackers to harvest the key and forge authenticated requests.

During an unauthenticated scan, middleBrick tests for Api Key Exposure by probing endpoints that rely on HMAC and checking whether the key is derivable from client-side artifacts or responses. For example, if a Sails API uses HMAC-SHA256 to sign query parameters and the signing logic is duplicated in frontend code, the static key can be extracted through source analysis or runtime inspection. Attackers can then replay signed requests to access protected resources, leading to data exposure or unauthorized operations.

The risk is compounded when nonces or timestamps are not used, allowing replay attacks with captured signatures. middleBrick checks for missing replay protections and insecure transmission by inspecting whether requests occur over TLS and whether signatures are tied to dynamic values. Without proper safeguards, an exposed HMAC key can lead to privilege escalation, data manipulation, or unauthorized administrative actions within the Sails backend.

Compliance frameworks such as OWASP API Top 10 and SOC2 highlight the importance of protecting authentication secrets. middleBrick maps findings like these to specific controls, ensuring that key exposure is treated with high priority. The scanner does not modify the application but identifies where HMAC implementations fall short, providing guidance to rotate keys and enforce stricter access controls.

To remediate HMAC-related key exposure in Sails, move all signing operations to the server side and ensure the secret key is never delivered to the client. Use environment variables to store the key and implement strict request validation on each endpoint. Below are concrete examples demonstrating secure HMAC signing and verification within a Sails controller.

First, configure a secure signing function that uses the built-in crypto module. Keep the secret in .env and load it via sails.config.custom or a secrets manager.

const crypto = require('crypto');

function generateHmac(payload, secret) {
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(JSON.stringify(payload));
  return hmac.digest('hex');
}

module.exports = { generateHmac };

In your controller, generate the signature server-side and append it to the response or use it to sign outgoing requests. Never include the secret in frontend code or logs.

module.exports.signPayment = async function (req, res) {
  const { amount, currency } = req.body;
  const secret = sails.config.custom.hmacSecret;
  const payload = { amount, currency, nonce: Date.now() };
  const signature = generateHmac(payload, secret);

  return res.ok({
    payload,
    signature,
    // Do not send the secret to the client
  });
};

For incoming requests that require HMAC verification, implement a middleware or policy that validates the signature before allowing access. Use a constant-time comparison to prevent timing attacks and include a nonce or timestamp to prevent replay attacks.

module.exports.verifyHmac = function (req, res, next) {
  const secret = sails.config.custom.hmacSecret;
  const receivedSignature = req.headers['x-signature'];
  const payload = {
    amount: req.body.amount,
    currency: req.body.currency,
    nonce: req.body.nonce,
  };

  const expectedSignature = generateHmac(payload, secret);
  const isValid = crypto.timingSafeEqual(
    Buffer.from(receivedSignature),
    Buffer.from(expectedSignature)
  );

  if (!isValid) {
    return res.unauthorized('Invalid signature');
  }

  // Optional: track used nonces to prevent replay
  return next();
};

Ensure TLS is enforced across all endpoints and rotate the HMAC secret periodically. middleBrick can validate these practices by re-scanning the API after changes and confirming that no keys appear in client-reachable responses. With the Pro plan, you can enable continuous monitoring to detect regressions and receive alerts if a new exposure is observed. The GitHub Action can gate CI/CD deployments, preventing releases that reintroduce key exposure risks.