Arp Spoofing in Hapi with Basic Auth

Arp spoofing is a link-layer attack in which an attacker sends falsified Address Resolution Protocol messages onto a local network to associate the attacker’s MAC address with the IP address of a legitimate host, such as a default gateway or another server. When this occurs on a network serving a Hapi application that uses HTTP Basic Authentication, the attack can intercept and modify traffic between clients and the server.

In a Hapi server using Basic Auth, credentials are transmitted in the Authorization header as a Base64-encoded string. If an attacker successfully spoofs the ARP tables for a client or the gateway, they can position themselves as a man-in-the-middle and observe or alter these requests. Because Basic Auth does not encrypt the credentials, the intercepted Authorization header reveals the username and password in a recoverable format. Even if TLS is used elsewhere, a local network attacker can exploit ARP spoofing to redirect traffic to an malicious host that terminates or relays the connection, bypassing intended network segmentation.

The risk is compounded in environments where Hapi services are deployed on shared or flat networks, such as development setups or containers without proper isolation. An attacker does not need to compromise the Hapi server itself; they only need network access to poison ARP caches. Once in the path, they can capture credentials, inject malicious payloads, or modify responses. This does not require breaking the application logic, but it does rely on the attacker’s ability to influence layer-2 forwarding, highlighting that application-level controls like Basic Auth must be paired with network protections to be effective.

middleBrick scans can detect unauthenticated endpoints and identify patterns that suggest missing network-level protections, such as missing host integrity checks or reliance on implicit network trust. While the scanner does not fix layer-2 issues, its findings encourage teams to couple transport security with infrastructure hardening to reduce the attack surface exposed by ARP spoofing.

To mitigate risks when using HTTP Basic Authentication in Hapi, move credentials out of the request path and enforce transport integrity. The following approaches are specific to Hapi and include concrete code examples.

1. Use TLS with strict transport security

Always serve Basic Auth over HTTPS to prevent credential exposure on the wire. Configure your TLS termination point (load balancer or Node.js TLS layer) with strong ciphers and redirect all HTTP traffic.

const Hapi = require('@hapi/hapi');
const tlsOptions = {
  key: fs.readFileSync('/path/to/server.key'),
  cert: fs.readFileSync('/path/to/server.crt')
};

const init = async () => {
  const server = Hapi.server({
    port: 443,
    host: '0.0.0.0',
    tls: tlsOptions
  });

  server.auth.scheme('basic', (server) => {
    return {
      authenticate: (request, h) => {
        const credentials = request.auth.credentials;
        // validate against a secure store
        return { isValid: true, credentials: { user: credentials.user } };
      }
    };
  });

  server.auth.strategy('simple', 'basic', { validateFunc: (request, username, password, options) => {
    // Replace with secure user/password verification
    const isValid = username === 'admin' && password === 's3cureP@ss!';
    return { isValid, credentials: { user: username } };
  }});

  server.route({
    method: 'GET',
    path: '/secure',
    options: {
      auth: 'simple',
      handler: (request, h) => ({ message: 'Authenticated access' })
    }
  });

  await server.start();
  console.log('Server running on %s', server.info.uri);
};

init();

2. Prefer token-based or session authentication

Replace Basic Auth with a session or token mechanism to avoid transmitting reusable credentials on every request. If you must keep Basic Auth for compatibility, enforce it only over VPNs or private networks and rotate credentials frequently.

const Hapi = require('@hapi/hapi');
const jwt = require('jsonwebtoken');

const init = async () => {
  const server = Hapi.server({ port: 8080 });

  // Token validation strategy
  server.auth.strategy('jwt', 'cookie', {
    cookie: 'access_token',
    isSecure: true,
    validateFunc: (request, cookie, callback) => {
      try {
        const decoded = jwt.verify(cookie, process.env.JWT_SECRET);
        return { isValid: true, credentials: decoded };
      } catch (err) {
        return { isValid: false };
      }
    }
  });

  server.route({
    method: 'GET',
    path: '/profile',
    options: {
      auth: 'jwt',
      handler: (request, h) => ({ user: request.auth.credentials })
    }
  });

  await server.start();
  console.log('Token-based server running on %s', server.info.uri);
};

init();

3. Network and infrastructure mitigations

Complement application changes with network controls: use VPCs, private subnets, and host-based firewall rules to limit which nodes can participate in ARP resolution. Employ static ARP entries for critical gateways where feasible and monitor for unexpected ARP replies using network detection tools.

middleBrick integrations such as the GitHub Action can be added to CI/CD pipelines to ensure new deployments do not weaken authentication requirements. The CLI and MCP Server options allow you to scan API configurations and validate that transport protections remain aligned with your security posture.