Brute Force Attack in Adonisjs with Basic Auth

A brute force attack against an Adonisjs application using HTTP Basic Authentication relies on repeatedly submitting username and password pairs until a valid combination is found. Because Basic Auth transmits credentials in an easily decoded base64 format, an attacker who can observe or intercept traffic gains no direct advantage here; the risk is online guessing against the login endpoint.

In Adonisjs, if routes protected by Basic Auth do not enforce any attempt-limiting mechanism, each request path that triggers the authentication handler represents an opportunity to test credentials. Adonisjs itself does not introduce a built-in lockout or rate-limiting behavior for Basic Auth routes, so the application must implement these controls. Without explicit guards, an attacker can send many sequential requests, cycling through common or guessed passwords. Each request completes with a 401 until the correct credentials are supplied, at which point the server returns a 200, confirming a successful guess.

The attack surface is shaped by how authentication is implemented. A naive implementation might directly compare the submitted credentials against a database record on every request, effectively turning each probe into a database lookup. If account lockout, exponential backoff, or captcha challenges are absent, the endpoint behaves like a standard login form with no protective friction. Attackers may use credential lists tailored to the application’s user base, leveraging known weak passwords or password reuse patterns. Even with encrypted storage, the lack of server-side rate limiting means that the only barrier is password complexity.

Because Basic Auth is stateless, session-based protections such as cookies are not applicable; mitigation must be applied at the route or middleware layer. For example, middleware that tracks failed attempts per IP or per username can introduce delays or block further probing. However, if these controls are inconsistently applied—say, only on certain routes or only after a threshold—some endpoints remain vulnerable. The scanning process performed by tools like middleBrick can surface these gaps by probing unprotected paths and verifying whether rate limiting and authentication checks are consistently enforced across the API surface.

Additional risk arises when Basic Auth is combined with other weaknesses, such as missing transport encryption or verbose error messages that reveal whether a username exists. Even in the absence of transport-layer encryption, the primary concern remains online guessing: the absence of throttling allows an attacker to iterate through passwords at network speed. Properly instrumented, an Adonisjs app should treat every Basic Auth request as a candidate for abuse if no attempt-limiting strategy is in place.

Remediation focuses on adding rate limiting, careful validation, and defense-in-depth around Basic Auth routes. Below are concrete, syntactically correct examples for Adonisjs that demonstrate how to secure these endpoints.

Example Basic Auth implementation in Adonisjs

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import { schema } from '@ioc:Adonis/Core/Validator'

export default class AuthController {
  public async basicAuth({ request, auth, response }: HttpContextContract) {
    const credentialsSchema = schema.create({
      username: schema.string.optional(),
      password: schema.string.optional(),
    })

    const validated = await request.validate({ schema: credentialsSchema })

    // Use Adonisjs native auth guard for Basic Auth
    const user = await auth.use('api').verify({ ...validated })
    if (!user) {
      return response.unauthorized()
    }

    return response.ok({ message: 'Authenticated' })
  }
}

Applying rate limiting to Basic Auth routes

Introduce a custom rate limiter or leverage Adonisjs built-in options to restrict attempts per identifier (username or IP). This example uses the built-in Throttler to limit login attempts.

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import { Throttler } from '@ioc:Adonis/Addons/Throttler'

export class BasicAuthController {
  public async login({ request, auth, response, throttle }: HttpContextContract) {
    const username = request.input('username')
    const identifier = username || request.ip()

    // Apply throttling: max 5 attempts per 60 seconds per identifier
    const throttler = new Throttler({
      duration: 60,
      max: 5,
    })

    const isThrottled = await throttle.throttle(identifier, throttler)
    if (isThrottled) {
      response.status(429).send({ error: 'Too many attempts, try again later.' })
      return
    }

    const credentials = request.only(['username', 'password'])
    const user = await auth.use('api').verify(credentials)

    if (!user) {
      // Optionally increment failed attempts explicitly
      await throttle.fail(identifier)
      return response.unauthorized()
    }

    // Reset on success
    await throttle.reset(identifier)
    return response.ok({ message: 'Authenticated' })
  }
}

Middleware to enforce authentication and rate limits globally

Registering a middleware that checks auth and applies throttling ensures consistent protection across endpoints that rely on Basic Auth.

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import { Throttler } from '@ioc:Adonis/Addons/Throttler'

export default class SecureBasicAuth {
  public async handle({ request, auth, response, next }: HttpContextContract) {
    const username = request.authUser?.username || request.ip()
    const throttler = new Throttler({
      duration: 60,
      max: 10,
    })
    const isThrottled = await throttler.throttle(username)
    if (isThrottled) {
      response.status(429).send({ error: 'Rate limit exceeded' })
      return
    }

    const user = await auth.check()
    if (!user) {
      await throttler.fail(username)
      return response.unauthorized()
    }

    await throttler.reset(username)
    await next()
  }
}

Additional hardening recommendations

• Enforce HTTPS to prevent on-path interception of base64-encoded credentials.
• Return uniform error messages to avoid user enumeration via timing or status differences.
• Prefer stronger mechanisms (e.g., token-based auth) where feasible; reserve Basic Auth for tightly controlled scenarios.
• Align with findings from middleBrick scans to verify that rate limiting is consistently applied across all authenticated routes and that no endpoints inadvertently bypass checks.