Beast Attack in Sails with Api Keys

A Beast Attack (short for BREACH or similar adaptive chosen‑plaintext attacks) in the context of Sails.js APIs that rely on static Api Keys can occur when an attacker can observe differences in response length or timing while supplying partial knowledge of a secret. In Sails, Api Keys are often passed via headers (e.g., x-api-key) and used for authorization checks. If authorization and data retrieval logic are not constant‑time and if responses vary in size based on whether a resource exists or matches a filter, an attacker can gradually recover sensitive information by measuring response sizes across many requests.

Consider a Sails controller that filters user records by an Api Key and returns a list of resources. If the key is valid but the requested resource does not exist, the response payload may be smaller than when the resource exists. An attacker without knowledge of the Api Key can brute‑force the key or infer properties of protected data by sending many crafted requests and observing network or application level timing and size differences. This is especially relevant when the same endpoint returns different JSON structures or lengths based on authorization outcomes, because the variation becomes a side channel.

In practice, this maps to common OWASP API Top 10 categories such as Broken Object Level Authorization (BOLA) and Sensitive Data Exposure when combined with weak key management. For example, if an Api Key is leaked in logs, client side storage, or referrer headers, an attacker can pivot to perform enumeration. Sails applications that generate non‑constant responses (e.g., dynamic error messages, variable length arrays) inadvertently train the side channel. The attack does not require authentication bypass if the Api Key is already exposed; it amplifies the impact of a leaked key by enabling data extraction through controlled queries.

middleBrick detects this risk as part of its BOLA/IDOR and Data Exposure checks, alongside input validation and rate limiting analysis. By correlating runtime responses with spec definitions (OpenAPI/Swagger 2.0/3.0/3.1 with full $ref resolution), the scanner highlights inconsistencies that may enable size‑based inference. Note that middleBrick reports findings with severity and remediation guidance, but it does not fix or block the endpoint; developers must apply the suggested mitigations.

For LLM‑related endpoints exposed without authentication, middleBrick’s unique LLM/AI Security checks also flag unauthenticated LLM endpoints that could be abused in conjunction with side‑channel data extraction. The scanner runs active prompt injection probes and reviews output for PII or keys, ensuring AI integrations do not widen the attack surface. On the product side, the CLI (middlebrick scan <url>) provides a quick, no‑setup assessment, while the Pro plan enables continuous monitoring and CI/CD integration to fail builds if risk scores degrade.

Remediation focuses on making authorization checks and responses constant‑time, avoiding information leaks, and protecting Api Keys at rest and in transit. Below are concrete Sails code examples that demonstrate secure patterns.

1. Use a constant‑time comparison for Api Keys and ensure uniform response shapes.

// api/controllers/SecureController.js
const crypto = require('crypto');

module.exports = {
  listResources: async function (req, res) {
    const suppliedKey = req.headers['x-api-key'];
    const expectedKey = sails.config.custom.apiKey; // stored securely, e.g., env var

    // Constant‑time comparison to avoid timing leaks
    const isValid = crypto.timingSafeEqual(
      Buffer.from(suppliedKey || ''),
      Buffer.from(expectedKey || '')
    );

    if (!isValid) {
      return res.unauthorized();
    }

    // Always return the same top‑level shape to prevent size leakage
    const resources = await Resource.find({/* filters not exposing key */});
    return res.ok({
      data: resources,
      meta: { count: resources.length }
    });
  }
};

2. Store Api Keys securely and reference them via environment variables; avoid hardcoding.

// .env (do not commit)
API_KEY=supersecrethashplaceholder

// config/custom.js
module.exports.custom = {
  apiKey: process.env.API_KEY
};

3. Enforce rate limiting and require additional context (e.g., rotating tokens) to reduce brute‑force feasibility.

// config/policies.js
module.exports.policies = {
  'SecureController': ['rateLimit', 'requireApiKey']
};

// api/policies/rateLimit.js
module.exports.rateLimit = function (req, res, next) {
  // Implement token bucket or similar; return res.status(429).send('Too many requests') if exceeded
  return next();
};

4. Validate and sanitize all inputs to prevent injection and ensure stable serialization.

// api/hooks/validate.js (custom hook example)
module.exports.validateRequest = function (req, res, next) {
  const query = req.query;
  if (query.limit) {
    const limit = parseInt(query.limit, 10);
    if (!Number.isFinite(limit) || limit < 1 || limit > 100) {
      return res.badRequest('Invalid limit');
    }
  }
  return next();
};

5. Use HTTPS and HTTP security headers to protect keys in transit and mitigate injection.

// config/http.js
module.exports.http = {
  middleware: {
    order: ['startRequestTimer', 'cookieParser', 'session', 'bodyParser', 'compress', 'helmet', 'secureController'],
    helmet: {
      contentSecurityPolicy: { directives: { defaultSrc: ["'self'"] } },
      hsts: { maxAge: 31536000, includeSubDomains: true }
    }
  }
};

Implementing these patterns reduces the effectiveness of size‑based side channels and protects Api Keys within a Sails application. middleBrick’s scans can verify whether such mitigations are reflected in runtime behavior, and the generated findings include severity and remediation guidance to support remediation efforts.