Brute Force Attack in Restify (Javascript)

Restify is a Node.js framework optimized for building REST APIs, often used for services requiring high throughput. When combined with JavaScript's asynchronous nature and common authentication patterns, Restify APIs can expose authentication endpoints to brute force attacks if rate limiting and account lockout mechanisms are not properly implemented. A typical scenario involves a POST /login endpoint that validates credentials without restricting request frequency. Attackers can automate thousands of login attempts per second using tools like Hydra or custom scripts, exploiting weak passwords or leaked credential lists. Since Restify does not include built-in brute force protection, developers must explicitly add middleware to monitor failed attempts per IP or username. Without such controls, the API remains vulnerable to credential stuffing, which can lead to account takeover, especially when combined with other flaws like missing multi-factor authentication or exposed password reset functions. OWASP API Security Top 10 (2023) lists broken authentication (API1:2023) as a primary risk, where brute force is a common attack vector. middleBrick detects this vulnerability by testing the unauthenticated attack surface, checking for missing rate limiting on authentication endpoints, and reporting findings with severity based on request volume tolerance and response patterns.

To mitigate brute force attacks in Restify APIs, implement rate limiting and account lockout logic using middleware. The following example uses the restify and restify-plugins packages to track failed login attempts per IP address and enforce temporary lockouts after a threshold. This solution stores attempt counts in memory (for demonstration; production should use Redis or a database) and resets after a cool-down period. The code integrates directly into a Restify server, protecting the /login endpoint without requiring external agents or configuration changes—aligning with middleBrick's agentless scanning approach.

const restify = require('restify');
const server = restify.createServer();

// In-memory store for failed attempts (use Redis in production)
const failedAttempts = new Map();
const LOCKOUT_DURATION = 15 * 60 * 1000; // 15 minutes
const MAX_ATTEMPTS = 5;

// Middleware to check and update failed attempts
function bruteForceProtection(req, res, next) {
  const ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
  const now = Date.now();

  if (failedAttempts.has(ip)) {
    const { count, firstAttempt } = failedAttempts.get(ip);
    
    // Reset if lockout period has passed
    if (now - firstAttempt > LOCKOUT_DURATION) {
      failedAttempts.delete(ip);
    } else if (count >= MAX_ATTEMPTS) {
      return res.send(429, { error: 'Too many login attempts. Try again later.' });
    }
  }

  res.on('after', () => {
    if (res.statusCode === 401 || res.statusCode === 403) {
      const data = failedAttempts.get(ip) || { count: 0, firstAttempt: now };
      data.count += 1;
      data.firstAttempt = data.firstAttempt || now;
      failedAttempts.set(ip, data);
    }
  });

  return next();
}

server.use(restify.plugins.bodyParser({ mapParams: false }));
server.use(bruteForceProtection);

server.post('/login', (req, res, next) => {
  const { username, password } = req.body;
  
  // Validate credentials (example logic)
  if (username !== 'admin' || password !== 'securePassword123') {
    return res.send(401, { error: 'Invalid credentials' });
  }

  // Clear failed attempts on successful login
  const ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
  failedAttempts.delete(ip);

  res.send(200, { token: 'fake-jwt-token' });
  return next();
});

server.listen(3000, () => {
  console.log('Server listening at http://localhost:3000');
});

This implementation prevents brute force by limiting login attempts per IP and enforcing temporary lockouts. For production, replace the in-memory store with a distributed system like Redis to support multiple server instances. middleBrick validates such protections during scanning by sending sequential authentication requests and analyzing response codes and timing, ensuring the API enforces appropriate throttling without blocking legitimate users.