Brute Force Attack in Adonisjs with Mutual Tls

A brute force attack against an AdonisJS application using mutual TLS (mTLS) focuses on the authentication boundary where client certificates are validated. In mTLS, the server requests a client certificate during the TLS handshake and typically maps the certificate to a user or role before application logic runs. If the endpoint that validates certificate mappings or the subsequent login/authorization flow does not enforce rate limiting, an attacker can rapidly present different valid client certificates (or reuse a certificate and vary other request dimensions) to trigger repeated authentication attempts without being throttled.

With AdonisJS, developers often handle mTLS at the reverse proxy or load balancer (e.g., terminating TLS and forwarding client certificate details in headers), or within Node code using a TLS server with request certificate options. When the application layer treats each certificate as a new authentication context and lacks per-identity or per-source rate limiting, brute force behavior becomes feasible: an attacker iterates over certificate identities or tokens, attempting to discover valid credentials or to enumerate authorized identities. Even when TLS itself is strong, the application can become the weakest link if it does not correlate mTLS subject information with request-rate controls.

Another angle is unauthenticated or weakly protected endpoints that still accept mTLS client certificates for authorization only. For example, an endpoint might allow access based on certificate fields (common name, organizational unit) but not enforce additional checks at the route level. An attacker can automate requests with different certificate subjects against these endpoints, relying on the server to accept any presented certificate that passes TLS validation. Since the scan category BOLA/IDOR and Authentication checks include unauthenticated attack surface testing, it can detect whether mTLS-accepted identities are being over-permissive or whether brute force attempts yield different authorization outcomes.

OpenAPI/Swagger analysis can highlight inconsistencies: if security schemes describe mutualTLS but the paths do not enforce required security checks on every operation, runtime testing may find deviations between spec and behavior. This matters because an attacker can probe operations that appear protected in documentation but are not enforced at runtime, effectively reducing mTLS to an optional gate. The scanner’s 12 security checks run in parallel, including Authentication and Authorization tests, to surface such gaps without requiring credentials.

In practical terms, a brute force risk against AdonisJS with mTLS arises when identity mapping, certificate validation, and rate limiting are not tightly coupled. Without per-identity throttling or adaptive controls, an attacker can cycle through certificates or tokens faster than the server can detect and respond, increasing the likelihood of unauthorized access or information disclosure about valid identities.

Remediation centers on ensuring that certificate identity is validated early and that rate limiting is applied per identity or per source. Below are concrete, syntactically correct examples for an AdonisJS project using the HTTPS server with mTLS and using header-based identity when terminating TLS at a proxy.

Example 1: Node TLS server with client certificate verification in AdonisJS

const https = require('https');
const fs = require('fs');
const { Ignitor } = require('@adonisjs/ignitor');

const server = https.createServer({
  cert: fs.readFileSync('path/to/server-cert.pem'),
  key: fs.readFileSync('path/to/server-key.pem'),
  requestCert: true,
  rejectUnauthorized: true, // enforce client certificate validation
  ca: [fs.readFileSync('path/to/ca-cert.pem')]
}, (req, res) => {
  const cert = req.client.authorized ? req.client.certificate : null;
  if (!cert) {
    res.statusCode = 401;
    res.end('Client certificate required');
    return;
  }
  const subject = cert.subject.match(/CN=([^,]+)/);
  const commonName = subject ? subject[1] : null;
  // TODO: map commonName to user, apply rate limiting per commonName
  // Forward to AdonisJS router or your request handler
  handleRequest(req, res);
});

server.listen(8443, () => {
  console.log('mTLS server listening on 8443');
});

Example 2: Express-style middleware within AdonisJS to validate certificate and enforce rate limits

const rateLimiter = require('some-rate-limiter'); // e.g., rate-limiter-flexible

function mtlsAuthMiddleware(ctx, next) {
  const cert = ctx.request.socket.getPeerCertificate && ctx.request.socket.getPeerCertificate();
  if (!cert || Object.keys(cert).length === 0) {
    ctx.response.status = 401;
    ctx.response.body = { error: 'Client certificate required' };
    return;
  }
  // Extract identity; adjust regex for your certificate format
  const subject = cert.subjectName || '';
  const match = subject.match(/CN=([^/]+)/);
  const identity = match ? match[1] : subject;
  if (!identity) {
    ctx.response.status = 400;
    ctx.response.body = { error: 'Certificate subject missing CN' };
    return;
  }
  // Enforce per-identity rate limiting
  const allowed = rateLimiter.check(identity, 5, 60000); // 5 requests per minute
  if (!allowed) {
    ctx.response.status = 429;
    ctx.response.body = { error: 'Too many requests' };
    return;
  }
  ctx.identity = identity;
  return next();
}

// In your start/routes.js
Route.use(mtlsAuthMiddleware).group(() => {
  Route.get('/profile', 'ProfileController.show');
});

Example 3: Proxy-forwarded identity with header-based validation

function validateProxyMtls(ctx, next) {
  const certSubject = ctx.request.header['x-client-cert-subject'];
  const certIssuer = ctx.request.header['x-client-cert-issuer'];
  if (!certSubject || !certIssuer) {
    ctx.response.status = 401;
    ctx.response.body = { error: 'Missing client certificate headers' };
    return;
  }
  // Basic validation that the issuer is your CA
  if (!certIssuer.includes('YourCA')) {
    ctx.response.status = 403;
    ctx.response.body = { error: 'Untrusted issuer' };
    return;
  }
  // Apply rate limiting by subject
  const allowed = rateLimiter.check(certSubject, 10, 60000);
  if (!allowed) {
    ctx.response.status = 429;
    ctx.response.body = { error: 'Too many requests' };
    return;
  }
  ctx.identity = certSubject;
  return next();
}

Operational and architectural recommendations

• Apply rate limiting per identity extracted from the certificate (common name, serial, or a custom mapping).
• Ensure that the server rejects unauthorized certificates (rejectUnauthorized: true) and validates the CA chain.
• Correlate mTLS identity with application-level permissions and avoid relying solely on TLS for fine-grained authorization.
• Use the CLI (middlebrick scan <url>) to verify that endpoints enforcing mTLS also enforce request-rate controls; the scanner can detect missing throttling on authentication-boundaries.
• If using the GitHub Action, set a threshold in your CI/CD pipeline so that scans failing to enforce per-identity rate limiting cause the build to fail.