Api Rate Abuse in Express with Hmac Signatures

Rate abuse in Express APIs that use Hmac signatures can occur when rate-limiting is applied before signature verification or when the same signature is accepted repeatedly without additional constraints. Hmac signatures bind a request to a shared secret and often include parameters such as timestamp and nonce. If an attacker discovers a valid signature, they may replay that request many times within a short window, bypassing intent-based abuse controls if the server does not enforce per-signature one-time use or strict timestamp windows.

Another scenario is when rate limits are applied to the endpoint or IP before the Hmac check. An attacker can exhaust the rate quota with unsigned or malformed requests, causing legitimate signed requests to be rejected or triggering inconsistent behavior. Alternatively, if the signature does not cover critical anti‑abuse metadata (e.g., request ID or a per‑user counter), an attacker can reuse a valid signature across multiple accounts or resources, enabling privilege escalation or data scraping at scale.

The vulnerability is specific to the interaction between how Express middleware ordering and signature validation logic are implemented. For example, if signature verification is performed after generic rate-limit middleware, an attacker can consume rate capacity without providing a valid Hmac, and the server might still process unsigned requests differently. Even when signatures are verified, without per‑key or per‑nonce tracking, an attacker can replay captured signed requests within the allowed timestamp skew window, effectively bypassing per‑user rate controls.

Real attack patterns include replay of intercepted signed requests, rapid cycling through nonces if the nonce validation is weak, or exploiting timestamp synchronization issues to reuse expired signatures within a relaxed window. These behaviors map to OWASP API Top 10 controls such as excessive data exposure and broken object level authorization when abuse leads to unauthorized access or data extraction.

To mitigate rate abuse with Hmac signatures in Express, ensure signature verification happens early in the middleware pipeline and that anti‑abuse controls are bound to the signature context. Track usage per key and per nonce, enforce tight timestamp windows, and include a request identifier inside the signed payload to prevent replay.

Example Express middleware that verifies Hmac signatures and enforces per‑key nonce and timestamp checks:

const crypto = require('crypto');
const express = require('express');
const app = express();

app.use(express.json());

const SECRET = process.env.HMAC_SECRET; // store securely
const MAX_SKEW_MS = 30000; // 30 seconds
const nonceStore = new Map(); // in production use Redis with TTL

function verifyHmac(req, res, next) {
  const signature = req.get('X-Signature');
  const timestamp = req.get('X-Timestamp');
  const nonce = req.get('X-Nonce');
  if (!signature || !timestamp || !nonce) {
    return res.status(401).json({ error: 'Missing authentication headers' });
  }
  const now = Date.now();
  if (Math.abs(now - parseInt(timestamp, 10)) > MAX_SKEW_MS) {
    return res.status(401).json({ error: 'Timestamp skew too large' });
  }
  const message = `${timestamp}${nonce}${JSON.stringify(req.body)}`;
  const expected = crypto.createHmac('sha256', SECRET).update(message).digest('hex');
  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  // replay protection: ensure nonce is unique per key within a window
  const key = req.get('X-API-Key') || 'unknown';
  const cacheKey = `${key}:${nonce}`;
  if (nonceStore.has(cacheKey)) {
    return res.status(403).json({ error: 'Replay detected' });
  }
  nonceStore.set(cacheKey, true);
  // Set TTL for nonce store entries (e.g., 2 minutes) to bound memory
  setTimeout(() => nonceStore.delete(cacheKey), 120000);
  next();
}

// Apply early, before generic rate limits
app.use(verifyHmac);

// Example endpoint
app.post('/resource', (req, res) => {
  res.json({ ok: true });
});

app.listen(3000, () => console.log('Server running on port 3000'));

In production, replace nonceStore with a distributed store (e.g., Redis) and enforce per‑key rate limits after successful verification. Include a unique request identifier within the signed body so that even proxied or batched requests can be deduplicated. Combine with Express rate-limiting middleware (e.g., express-rate-limit) keyed by API key to cap requests per consumer, ensuring that the Hmac context is considered when evaluating abuse rather than only IP or endpoint counts.