Arp Spoofing in Express with Basic Auth

Arp spoofing is a network-layer attack where an attacker sends falsified Address Resolution Protocol messages to associate their MAC address with the IP address of a legitimate host, typically the default gateway. In an Express application that relies on HTTP Basic Authentication, this attack becomes particularly relevant because credentials are transmitted in each request header.

When an Express server uses Basic Auth without TLS, an attacker on the same local network can perform arp spoofing to position themselves as a man-in-the-middle. The attacker intercepts authentication requests and responses, capturing the base64-encoded credentials sent in the Authorization header. Because Basic Auth credentials are only base64-encoded and not encrypted, the attacker can decode them and gain valid credentials for the application.

The combination of arp spoofing and Express with Basic Auth is risky because the attack does not require compromising the server itself; it operates on the local network segment. If the Express app is deployed in an environment where untrusted network access is possible, such as shared office Wi-Fi or cloud-hosted infrastructure with exposed network boundaries, the attack surface is widened. Even if the app uses session cookies after initial authentication, the initial exchange of credentials via Basic Auth can be intercepted during the spoofing phase.

While arp spoofing does not directly exploit Express or HTTP, it exposes weaknesses in the deployment environment and transport security. The framework itself does not mitigate network-level attacks; it simply processes requests as received. Therefore, an Express application using Basic Auth must assume that network-layer attacks like arp spoofing are feasible if proper safeguards are absent.

To reduce exposure, developers should avoid using Basic Auth over unencrypted channels and instead enforce HTTPS for all endpoints. MiddleBrick scans can detect unencrypted transmission of credentials and flag missing transport layer protections as part of its Data Exposure and Encryption checks.

Remediation focuses on eliminating the use of cleartext credentials and ensuring that authentication cannot be trivially intercepted via network attacks such as arp spoofing. The primary fix is to enforce HTTPS so that all traffic, including Authorization headers, is encrypted in transit.

Below are concrete Express code examples that implement Basic Auth securely by combining HTTPS enforcement and avoiding plain-text credential handling.

Example 1: Enforce HTTPS and use Basic Auth only over secure channels

const https = require('https');
const fs = require('fs');
const express = require('express');
const app = express();

const options = {
  key: fs.readFileSync('server.key'),
  cert: fs.readFileSync('server.cert')
};

// Middleware to enforce HTTPS in production
app.use((req, res, next) => {
  if (process.env.NODE_ENV === 'production' && !req.secure) {
    return res.status(403).send('HTTPS required');
  }
  next();
});

// Basic Auth middleware
const authMiddleware = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  if (!authHeader || !authHeader.startsWith('Basic ')) {
    res.set('WWW-Authenticate', 'Basic realm="Access"');
    return res.status(401).send('Authentication required');
  }
  const base64 = authHeader.split(' ')[1];
  const decoded = Buffer.from(base64, 'base64').toString('utf-8');
  const [user, pass] = decoded.split(':');

  // Replace with secure credential verification
  if (user === process.env.ADMIN_USER && pass === process.env.ADMIN_PASS) {
    return next();
  }
  res.set('WWW-Authenticate', 'Basic realm="Access"');
  res.status(401).send('Invalid credentials');
};

app.use(authMiddleware);

app.get('/secure', (req, res) => {
  res.send('Authenticated access granted');
});

https.createServer(options, app).listen(443, () => {
  console.log('HTTPS server running on port 443');
});

Example 2: Use environment variables and avoid hardcoded credentials

const express = require('express');
const app = express();

// Validate environment variables at startup
if (!process.env.BASIC_AUTH_USER || !process.env.BASIC_AUTH_PASS) {
  console.error('Missing BASIC_AUTH_USER or BASIC_AUTH_PASS environment variables');
  process.exit(1);
}

app.use((req, res, next) => {
  const auth = req.headers['authorization'];
  if (!auth || auth.indexOf('Basic ') !== 0) {
    res.set('WWW-Authenticate', 'Basic realm="API"');
    return res.status(401).send('Authorization header missing');
  }
  const token = Buffer.from(auth.split(' ')[1], 'base64').toString('ascii');
  const [user, pass] = token.split(':');
  if (user === process.env.BASIC_AUTH_USER && pass === process.env.BASIC_AUTH_PASS) {
    return next();
  }
  res.set('WWW-Authenticate', 'Basic realm="API"');
  res.status(401).send('Invalid credentials');
});

app.get('/api/data', (req, res) => {
  res.json({ message: 'Secure data endpoint' });
});

app.listen(3000, () => {
  console.log('Server running on port 3000 with HTTPS enforcement recommended');
});

These examples emphasize secure transport and proper credential handling. MiddleBrick can verify that such protections are in place by scanning for missing HTTPS and improper authentication handling.