Arp Spoofing in Hapi (Javascript)

Man-in-the-middle (MITM) attacks on Node.js APIs built with Hapi often begin with ARP spoofing in a network environment. ARP spoofing allows an attacker on the same local network to associate their MAC address with the IP address of a trusted host—such as the gateway or an API server—causing traffic intended for that host to be redirected to the attacker's machine. In a Hapi application, if the server relies on network-level trust (e.g., assuming all inbound requests come from authenticated internal services), an ARP spoofed client can inject malicious requests that appear to originate from a legitimate source.

Because Hapi does not validate the source MAC address or enforce network-level trust boundaries, it cannot detect that the TCP connection has been hijacked. Once the attacker successfully spoofs the IP, they can perform session hijacking, replay attacks, or redirect API calls to a malicious endpoint. This is especially dangerous when Hapi APIs are exposed to untrusted networks without TLS termination at the edge or without mutual TLS (mTLS) between services.

In practice, ARP spoofing enables an attacker to intercept API calls made by other services or clients that are supposed to be internal. For example, a service querying a Hapi endpoint for user data may instead send its request to the attacker's server, which can alter the response or extract sensitive data. Since Hapi runs in JavaScript, all request handling, routing, and authentication logic is exposed to the attacker if they control the response path.

Detection of ARP spoofing requires network monitoring tools like Wireshark or Zeek, but API developers can reduce exposure by enforcing strict network segmentation, using switch port security (e.g., limiting MAC addresses per port), and enabling dynamic ARP inspection where available. Additionally, API servers should not implicitly trust the caller's IP address without additional verification, such as client certificates or signed request tokens.

To mitigate ARP spoofing risks in a Hapi application, developers must assume that network-layer trust cannot be relied upon and implement application-layer validation. While Hapi does not provide built-in ARP protection (as it operates at the HTTP layer), you can strengthen your API by enforcing authentication at the application level and validating request provenance through means other than IP address alone.

One effective pattern is to use mutual TLS (mTLS) between services, where each service presents a client certificate. This ensures that even if an attacker spoofs the IP address, they cannot complete the TLS handshake without a valid certificate signed by a trusted CA. Below is a Hapi server configuration that enforces mTLS using the hapi-tls plugin:

const Hapi = require('@hapi/hapi');
const tls = require('hapi-tls');

const server = new Hapi.Server({
  host: '0.0.0.0',
  port: 443
});

server.register(tls);

server.route({
  method: 'GET',
  path: '/api/data',
  handler: function (request) {
    return { message: 'Secure data' };
  },
  options: {
    tls: {
      ca: [fs.readFileSync('/path/to/ca.crt')],
      cert: fs.readFileSync('/path/to/server.crt'),
      key: fs.readFileSync('/path/to/server.key'),
      requestCert: true,
      rejectUnauthorized: true
    }
  }
});

server.start();