Arp Spoofing in Sails with Basic Auth

Arp spoofing is a network-layer attack where an attacker falsifies Address Resolution Protocol messages to associate their MAC address with the IP address of a legitimate host, such as a server or another client. In a Sails.js application that relies on HTTP Basic Authentication, this attack becomes especially consequential because credentials are transmitted in each request header as a base64-encoded string. Although base64 is not encryption, an attacker who successfully positions themselves on the local network via ARP spoofing can capture these headers and decode the credentials in real time.

Sails does not provide built-in transport-layer protections; it serves application logic over the transport configured in the environment. If the deployment relies on HTTP rather than TLS-encrypted HTTPS, an attacker conducting ARP spoofing can intercept Basic Auth headers without needing to break the application code. The attack flow typically involves three phases: network positioning, credential capture, and possible lateral movement. By spoofing the gateway or another backend node, the attacker can redirect traffic through their host and log incoming requests. Because Basic Auth credentials are static per user until changed, captured credentials remain valid until expiration or revocation, enabling persistent unauthorized access.

The combination of Sails’ convention-over-configuration style and unencrypted Basic Auth creates a scenario where the attack surface extends beyond the application logic into the network segment. An attacker does not need to exploit a vulnerability in Sails itself; they exploit the insecure transport and weak authentication mechanism. Once credentials are obtained, the attacker can replay requests, escalate privileges via exposed endpoints, or pivot to internal services that trust the same authentication scheme. This illustrates why network-level protections and secure transport are prerequisites when using Basic Authentication, regardless of the web framework in use.

Remediation centers on replacing Basic Auth over HTTP with HTTPS and implementing stronger authentication patterns. For existing services that must use Basic Auth, enforce TLS termination at the proxy or load balancer and ensure Sails only listens on localhost or a private network when behind a secure front door. The following examples demonstrate how to configure Sails to require HTTPS and to validate Authorization headers securely.

First, enforce HTTPS in your Sails configuration by setting up a custom hook or policy that checks the request protocol. In config/http.js, you can define a policy that rejects non-TLS requests for sensitive routes:

// config/http.js
module.exports.http = {
  middleware: {
    enforceHttps: function (req, res, next) {
      if (process.env.NODE_ENV === 'production' && req.protocol !== 'https') {
        return res.redirect('https://' + req.headers.host + req.url);
      }
      return next();
    },
    order: ['enforceHttps', 'sessionAuth', 'bodyParser', 'router'],
    sessionAuth: function (req, res, next) {
      const auth = req.headers.authorization;
      if (!auth || !auth.startsWith('Basic ')) {
        res.set('WWW-Authenticate', 'Basic realm="Access"');
        return res.unauthorized('Missing credentials');
      }
      const base64 = auth.split(' ')[1];
      const decoded = Buffer.from(base64, 'base64').toString('utf-8');
      const [username, password] = decoded.split(':');
      if (username === process.env.BASIC_USER && password === process.env.BASIC_PASS) {
        req.user = { username };
        return next();
      }
      res.set('WWW-Authenticate', 'Basic realm="Access"');
      return res.unauthorized('Invalid credentials');
    }
  }
};

Second, use environment variables to avoid hardcoding credentials. In your shell, export the variables before starting Sails:

export BASIC_USER=admin
export BASIC_PASS=$(openssl rand -base64 18)
sails lift

Third, consider replacing Basic Auth with token-based or session-based authentication for non-browser clients. For example, issue a short-lived JWT after initial credentials are validated, and require that token in subsequent requests. This reduces the exposure window of static credentials captured via ARP spoofing.