HIGH replay attackmutual tls
Replay Attack with Mutual Tls
How Replay Attack Manifests in Mutual TLS
const tls = require('tls');
const fs = require('fs');
const options = {
key: fs.readFileSync('server-key.pem'),
cert: fs.readFileSync('server-cert.pem'),
ca: fs.readFileSync('ca.pem'), // trust client CAs
requestCert: true,
rejectUnauthorized: true
};
const server = tls.createServer(options, (cleartextStream) => {
// Client certificate is validated, but we do not check any request‑specific freshness.
cleartextStream.on('data', (chunk) => {
// Process the request directly – vulnerable to replay.
cleartextStream.write('OK\n');
});
});
server.listen(8443, () => {
console.log('mTLS server listening on 8443');
});
Mutual TLS‑Specific Detection
Results appear in the web dashboard where you can track the security score over time, view the per‑category breakdown, and see the exact request that was replayed. The same check is available in the GitHub Action for CI/CD pipelines and via the MCP Server for scanning directly from AI‑assisted IDEs.
Mutual TLS‑Specific Remediation
Alternative mitigations include using TLS 1.3’s early‑data anti‑replay mechanism, or having the client sign a nonce with its private key and including that signature in a header (similar to mTLS + JWT). Whichever method you choose, middleBrick will continue to detect missing freshness controls and report them so you can verify that the fix is effective before deploying to production.
Frequently Asked Questions
Does middleBrick block replay attacks when it detects them?
No. middleBrick only detects and reports the vulnerability; it does not block, fix, or modify the API. It provides detailed findings and remediation guidance so you can apply the appropriate fix in your code or configuration.
Can I test for replay attacks in a staging environment before promoting to production?
Yes. Use the middleBrick GitHub Action or CLI to scan your staging API as part of your CI/CD pipeline. The action can be configured to fail the build if the security score drops below a threshold, giving you confidence that replay mitigations are in place before deployment.