Brute Force Attack in Adonisjs (Typescript)

A brute force attack exploits weak or missing rate limiting on authentication endpoints in web frameworks like Adonisjs when implemented without proper safeguards. In Adonisjs applications written in Typescript, attackers can systematically guess credentials by sending large volumes of login requests against the POST /auth/login endpoint. Because Adonisjs does not enforce rate limiting by default, and because Typescript type definitions do not prevent credential spraying, attackers can automate thousands of attempts using tools like curl or custom scripts.

This vulnerability is particularly pronounced in APIs that use session-based or token authentication without additional throttling. The combination of Adonisjs's modular architecture and the lack of built-in request throttling creates an unauthenticated attack surface where attackers can iterate rapidly through username or password combinations. Real-world examples include credential stuffing campaigns targeting SaaS platforms that rely on Adonisjs for backend APIs, where automated tools cycle through common password lists against exposed auth endpoints.

Such attacks fall under the OWASP API Top 10 category Rate Limiting and map directly to CWE-307 (XML External Entity) when misconfigured endpoints expose authentication logic without protection. Unlike server-side request forgery (SSRF) or improper authorization (BOLA), brute force is distinguished by its focus on computational exhaustion of secrets rather than structural flaws in data handling.

middleBrick detects this risk pattern through its Authentication and Rate Limiting checks, scanning the /auth/login endpoint for signs of excessive response variability or lack of throttling headers. While the scanner does not perform live brute force attempts, it identifies missing rate limiting controls by analyzing response consistency, missing Retry-After headers, and absence of token-based throttling mechanisms. This enables developers to surface the risk before deployment.

Importantly, middleBrick reports on this vulnerability without altering application behavior or blocking traffic. It provides a prioritized finding with severity classification and remediation guidance, helping teams understand how to implement rate limiting controls in their Adonisjs API layers.

To remediate brute force vulnerabilities in Adonisjs with Typescript, developers must explicitly implement rate limiting at the authentication endpoint. This is typically done using middleware that tracks request volume per IP or user identifier and returns a 429 Too Many Requests response when thresholds are exceeded.

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

class RateLimiterMiddleware {
  public async handle ({ request, response }: HttpContextContract, next: () => Promise) {
    const ip = request.ip()
    const key = `rate_limit:${ip}`
    const limit = 10 // max 10 requests per minute
    const ttl = 60 // seconds

    // Simple in-memory counter (not recommended for production clusters)
    const count = await request.app.container
      .use('Redis')
      .hGet(key, 'count')
      .then((current) => current ? parseInt(current) : 0)

    if (count >= limit) {
      response.status(429).send({ error: 'Too many login attempts' })
      return
    }

    await request.app.container
      .use('Redis')
      .hSet(key, 'count', count + 1)
      .hSetExpire(key, ttl, 1)

    await next()
  }
}

// In your router
exports = {
  async: {
    routes: [
      {
        method: 'POST',
        path: 'auth/login',
        controller: 'AuthController.login',
        preRoutes: ['RateLimiterMiddleware']
      }
    ]
  }
}

This example shows how developers can integrate rate limiting using a middleware that tracks request counts per IP. However, for production environments, a distributed store like Redis should be used to maintain consistency across multiple instances. The Typescript type system ensures that the middleware receives proper context contracts, reducing runtime errors.

Additionally, Adonisjs supports built-in throttling via the throttle helper in the @adonisjs/core package, which can be configured with fine-grained rules:

import { HttpContext } from '@ioc:Adonis/Core/HttpContext'

public async login ({ request, response }: HttpContextContract) {
  // Throttle login attempts per IP: 5 requests per minute
  const ip = request.ip()
  const key = `login:${ip}`
  const count = await Database.table('api_throttle').where('key', key).first()

  if (count && count.requests >= 5) {
    return response.status(429).send({ message: 'Too many attempts' })
  }

  // Increment and set expiry
  await Database.table('api_throttle').insert({
    key,
    requests: (count?.requests || 0) + 1,
    expires_at: new Date(Date.now() + 60_000)
  })

  // Proceed with authentication logic
  const { email, password } = request.only(['email', 'password'])
  // ...
}

These examples demonstrate concrete Typescript patterns for implementing rate limiting in Adonisjs. middleBrick’s Rate Limiting and Authentication checks will validate that such controls are in place and report if they are missing or misconfigured. The scanner does not modify code but highlights gaps so teams can apply secure defaults.

By integrating middleBrick into CI/CD pipelines, developers can ensure that every API endpoint is scanned for rate limiting compliance before staging or production deployment.