Api Key Exposure in Sails with Cockroachdb

When a Sails.js application connects to Cockroachdb without strict controls, API keys or database credentials can be inadvertently exposed through logs, error messages, or misconfigured connection strings. Sails, an MVC framework for Node.js, often stores connection details in configuration files such as config/connections.js and references them in models. If these values are hardcoded, committed to version control, or transmitted over unencrypted channels, they become accessible to unauthorized parties.

During a middleBrick scan testing the unauthenticated attack surface, findings related to Api Key Exposure in this context may include:

• Database connection strings containing embedded credentials returned in error traces
• Environment variables or config files accessible due to overly permissive file permissions
• Logs or debug endpoints revealing sensitive keys through verbose output or improper error handling

Cockroachdb, being a distributed SQL database, uses secure connection parameters including certificates and passwords. In Sails, these are typically configured under config/connections.js. If the configuration does not enforce encrypted transport and strict access controls, an attacker may leverage common weaknesses such as insecure direct object references (IDOR) or improper input validation to reach endpoints that return sensitive configuration data. For example, an unauthenticated route that returns diagnostic information might inadvertently include a Cockroachdb connection string, exposing the API key or certificate path.

The OWASP API Security Top 10 category of Broken Object Level Authorization (BOLA) can intersect with this issue when endpoints that should be restricted return data that includes database credentials. Additionally, without proper rate limiting and input validation, automated probes can trigger verbose errors that leak keys. middleBrick’s checks for Data Exposure, Authentication, and Input Validation help detect these conditions across the unauthenticated surface of a Sails + Cockroachdb deployment.

Compliance frameworks such as PCI-DSS and GDPR require protection of credentials and sensitive data. middleBrick scans map findings to these frameworks, highlighting areas where Api Key Exposure may lead to non-compliance. The scanner evaluates encryption in transit, checks for exposed secrets in responses, and verifies that connection practices follow security best practices.

To remediate Api Key Exposure when using Cockroachdb with Sails, ensure that connection credentials are never hardcoded and are injected through environment variables or secure vaults. Use encrypted transport and avoid exposing configuration details in responses or logs. The following examples demonstrate secure patterns.

1. Secure connection configuration using environment variables in config/connections.js:

module.exports.connections = {
  cockroachdb: {
    adapter: 'sails-cockroachdb',
    host: process.env.CRDB_HOST || 'localhost',
    port: parseInt(process.env.CRDB_PORT, 10) || 26257,
    user: process.env.CRDB_USER || 'root',
    password: process.env.CRDB_PASSWORD,
    database: process.env.CRDB_DATABASE || 'defaultdb',
    ssl: {
      rejectUnauthorized: true,
      // Provide CA certificate path if using self-signed certs
      ca: process.env.CRDB_CA ? require('fs').readFileSync(process.env.CRDB_CA) : undefined
    },
    schema: true
  }
};

2. Model definition referencing the secure connection:

module.exports.models = {
  connectionSource: 'cockroachdb',
  migrate: 'safe'
};

3. Example of a protected endpoint that avoids leaking configuration in error messages:

module.exports = {
  friendlyName: 'Secure Data Endpoint',
  description: 'Fetches data without exposing connection details',
  inputs: {
    id: { type: 'string', required: true }
  },
  exits: {
    serverError: {
      description: 'Handles errors without exposing internal details',
      responseType: 'json'
    }
  },
  fn: async function (inputs, exits) {
    try {
      const record = await CockroachModel.findOne(inputs.id);
      if (!record) {
        return exits.notFound({ error: 'Record not found' });
      }
      return exits.success(record);
    } catch (err) {
      sails.log.error('Database operation failed:', err.message);
      return exits.serverError({ error: 'Unable to process request' });
    }
  }
};

4. Enforce encrypted connections by configuring the adapter to require TLS and validating certificates. Avoid using ssl: false or disabling certificate verification in production.

These practices reduce the risk of Api Key Exposure and align with checks performed by middleBrick’s scans for Encryption, Data Exposure, and Authentication. The CLI tool can be used locally with middlebrick scan <url>, while the GitHub Action helps enforce these standards in CI/CD pipelines.