Bleichenbacher Attack in Koa with Bearer Tokens

A Bleichenbacher attack is a practical adaptive chosen-ciphertext attack against asymmetric encryption schemes that use PKCS#1 v1.5 padding, commonly associated with RSA. When a Koa application uses Bearer Tokens that are cryptographically signed with RSA-based algorithms such as RS256, and token validation does not properly enforce strict padding checks, the combination creates a potential Bleichenbacher vulnerability. Instead of focusing on token content, the attack targets the decryption and verification process: the attacker submits many modified tokens with slightly altered ciphertexts and observes differences in error responses or timing to infer information about the padding structure and ultimately recover the plaintext or forge tokens.

In Koa, this risk arises when the server relies on a library that performs RSA decryption or verification without constant-time or padding-safe implementations, and when Bearer Token validation endpoints provide distinguishable responses for invalid padding versus invalid signatures. For example, if a Koa route accepts an Authorization header like Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9... and passes the token to a verification function that leaks whether a padding error occurred, an attacker can iteratively adjust ciphertext blocks and observe HTTP status codes or response times to gradually decrypt or forge a valid Bearer Token.

The attack workflow in this specific context includes: (1) intercepting a valid Bearer Token, (2) modifying the token’s ciphertext portion, (3) sending it to the Koa API, (4) analyzing server responses to detect padding validity indications, and (5) repeating the process to recover the RSA plaintext or forge a token with elevated claims. Even if the token is cryptographically sound, an API that does not enforce strict algorithm checks (e.g., accepting asymmetric keys for symmetric algorithms) can amplify the impact by allowing substitution with a public key that the attacker controls.

For Koa applications, mitigating this requires more than input sanitization; it requires secure token handling practices that avoid leaking padding errors, enforce strict algorithm whitelisting, and use robust libraries. This aligns with findings from security scans that highlight Authentication and BOLA/IDOR checks when RSA-based tokens are involved. Developers should also consider integrating scans that test authentication endpoints for adaptive chosen-ciphertext behaviors, especially when Bearer Tokens use asymmetric cryptography.

middleBrick’s Authentication and BOLA/IDOR checks can help surface such risks by examining token validation paths and error handling behaviors, while its LLM/AI Security module can detect insecure configurations where token leakage or side channels may exist. Using the CLI, teams can regularly run middlebrick scan <url> to validate that their Koa endpoints do not expose padding-related timing differences or inconsistent error responses.

Remediation for Bleichenbacher-style risks with Bearer Tokens in Koa centers on robust cryptographic practices, constant-time verification, and strict algorithm enforcement. Below are concrete, actionable code examples that demonstrate secure handling of RS258-signed Bearer Tokens using the jsonwebtoken library and koa.

1. Enforce algorithm whitelisting and reject asymmetric keys for signing

Ensure your JWT verification explicitly allows only expected algorithms and does not accept algorithm switching attacks. Never use tokens that allow the none algorithm or permit asymmetric keys where a symmetric secret is expected.

const jwt = require('jsonwebtoken');
const Koa = require('koa');
const app = new Koa();

const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----`;

app.use(async (ctx, next) => {
  const auth = ctx.request.header.authorization || '';
  const token = auth.startsWith('Bearer ') ? auth.slice(7) : null;
  if (!token) {
    ctx.status = 401;
    ctx.body = { error: 'unauthorized' };
    return;
  }
  try {
    // Explicitly specify algorithms and do not allow 'none'
    const decoded = jwt.verify(token, PUBLIC_KEY, {
      algorithms: ['RS256'],
    });
    ctx.state.user = decoded;
    await next();
  } catch (err) {
    // Use a generic error to avoid leaking padding or parsing details
    ctx.status = 401;
    ctx.body = { error: 'invalid_token' };
  }
});

2. Use constant-time comparison and avoid error message distinctions

Ensure that your error handling does not differentiate between a malformed token, a bad signature, or a padding error. Return the same generic response and avoid logging internal details that could aid an attacker.

// Within your middleware, keep responses uniform
app.use(async (ctx, next) => {
  const auth = ctx.request.header.authorization || '';
  const token = auth.startsWith('Bearer ') ? auth.slice(7) : null;
  if (!token) {
    ctx.status = 401;
    ctx.body = { error: 'invalid_token' };
    return;
  }
  try {
    const decoded = jwt.verify(token, PUBLIC_KEY, { algorithms: ['RS256'] });
    ctx.state.user = decoded;
    await next();
  } catch (err) {
    // Always return the same status and message
    ctx.status = 401;
    ctx.body = { error: 'invalid_token' };
  }
});

3. Validate token structure before verification and use secure key management

Check token header and claims before attempting verification to avoid unnecessary cryptographic operations that may leak information. Rotate keys and store public keys securely, not embedded in source code.

function isValidTokenStructure(token) {
  try {
    const header = JSON.parse(Buffer.from(token.split('.')[0], 'base64').toString());
    return header.alg === 'RS256' && header.typ === 'JWT';
  } catch {
    return false;
  }
}

app.use(async (ctx, next) => {
  const auth = ctx.request.header.authorization || '';
  const token = auth.startsWith('Bearer ') ? auth.slice(7) : null;
  if (!token || !isValidTokenStructure(token)) {
    ctx.status = 401;
    ctx.body = { error: 'invalid_token' };
    return;
  }
  try {
    const decoded = jwt.verify(token, PUBLIC_KEY, { algorithms: ['RS256'] });
    ctx.state.user = decoded;
    await next();
  } catch (err) {
    ctx.status = 401;
    ctx.body = { error: 'invalid_token' };
  }
});

These examples emphasize strict algorithm control, avoiding distinguishable error paths, and using well-maintained libraries. They complement broader practices such as rate limiting and monitoring for unusual token request patterns. For ongoing assurance, teams can use middleBrick’s GitHub Action to enforce security thresholds in CI/CD and the MCP Server to scan APIs directly from development environments like Claude or Cursor.