Brute Force Attack in Hapi with Cockroachdb

A brute force attack against a Hapi application using CockroachDB typically targets authentication endpoints where login attempts are performed with many different credentials. Because Hapi is a Node.js web framework, attackers may attempt credential stuffing or password spraying if rate limiting is weak or absent. CockroachDB, being a distributed SQL database, stores user credentials and related metadata; if queries are not carefully constructed, timing differences or error messages can leak information that aids an attacker.

One common pattern in Hapi is to look up a user by username or email and then compare a provided password against a stored hash. If the comparison is performed in application code without constant-time checks, or if the query path differs for existing versus non-existing users, an attacker can infer valid accounts. For example, a route handler might first query CockroachDB to check whether a username exists, then conditionally proceed to password verification. This conditional branching creates a timing side channel.

Consider a Hapi route that directly builds a SQL string based on request input without parameterized queries or strict input validation:

// Example of a vulnerable pattern in Hapi with CockroachDB
const username = request.query.username;
const sql = `SELECT id, password_hash FROM users WHERE username = '${username}'`;
const result = await pool.query(sql);

This approach is susceptible to both SQL injection and user enumeration. If an attacker iterates through common usernames and observes differences in response codes or timing, they can learn which accounts exist. CockroachDB may return slightly different errors or latencies depending on whether a row is found, especially if indexes are involved. Without proper rate limiting, an unauthenticated attacker can make many requests and gradually harvest valid accounts.

Another vector involves password reset or login endpoints that provide uniform responses but implement throttling inconsistently. If only certain endpoints are rate-limited, attackers can shift to other paths. Even when rate limiting exists, weak policies that allow too many attempts per identifier (IP, username, or session) make brute force feasible. In distributed CockroachDB deployments, request routing and retry logic may also inadvertently amplify request volume if client retries are not carefully managed.

Authentication flows that do not enforce exponential backoff or account lockout after repeated failures are particularly risky. Hapi servers may rely on external plugins or custom logic for throttling; if these are not applied consistently across all authentication routes, an attacker can focus on the unprotected paths. The combination of Hapi’s flexible routing and CockroachDB’s strong consistency can make poorly implemented protections appear functional while still leaking information through side channels.

To mitigate brute force risks in a Hapi application backed by CockroachDB, use parameterized queries, consistent timing behavior, and robust rate limiting. Always use placeholders and pass values separately so the database driver can handle escaping correctly.

Replace string interpolation with parameterized statements. For example, using the pg driver (which works with CockroachDB) in a Hapi route:

// Secure parameterized query in Hapi with CockroachDB
const username = request.query.username;
const password = request.payload.password;

const sql = 'SELECT id, password_hash FROM users WHERE username = $1';
const result = await pool.query(sql, [username]);

if (result.rows.length === 0) {
  // Still perform hash comparison to avoid timing leaks
  await bcrypt.compare(password, dummyHash);
  return reply.response('Invalid credentials').code(401);
}

const user = result.rows[0];
const match = await bcrypt.compare(password, user.password_hash);
if (!match) {
  return reply.response('Invalid credentials').code(401);
}

return reply.response({ userId: user.id });

This approach ensures the query plan is consistent regardless of whether the username exists, reducing timing variability. Even when the user is not found, perform a dummy hash comparison to keep response times similar and avoid account enumeration through response timing.

Apply rate limiting at the server level and enforce it uniformly. Hapi provides built-in facilities to apply rate limiting across routes:

// Hapi server setup with rate limiting
const Hapi = require('@hapi/hapi');
const RateLimiter = require('some-rate-limiter'); // e.g., a consistent-store-based limiter

const init = async () => {
  const server = Hapi.server({ port: 4000, host: 'localhost' });

  server.ext('onPreAuth', async (request, h) => {
    const identifier = request.auth.credentials ? request.auth.credentials.username : request.info.remoteAddress;
    const allowed = await RateLimiter.check(identifier, { max: 5, window: 60 });
    if (!allowed) {
      return h.response({ error: 'Too many attempts' }).code(429);
    }
    return h.continue;
  });

  server.route({
    method: 'POST',
    path: '/login',
    handler: (request, reply) => { /* authentication logic */ }
  });

  await server.start();
};

Use a rate limiter backed by a distributed store so limits are respected across nodes in a CockroachDB cluster. Avoid storing only IP-based limits if multiple users share network addresses; include usernames or account IDs where feasible to prevent attackers from shifting targets within the same IP.

Implement exponential backoff and progressive delays on failed attempts without revealing the state through timing or response content. Combine this with account lockout policies after a threshold, while ensuring lockout cannot be abused to deny service to legitimate users via mass enumeration.

Regularly review authentication logs and monitor for patterns indicative of brute force activity. Because CockroachDB excels at strong consistency, ensure your retry and transaction logic does not unintentionally increase request volume during client-side retries. Configure Hapi’s retry and timeout settings to align with CockroachDB’s operational characteristics to avoid amplifying traffic during legitimate failures.