Cache Poisoning in Adonisjs with Cockroachdb

Cache poisoning in the Adonisjs + Cockroachdb context occurs when an attacker influences cached data so that subsequent reads return incorrect or malicious results. This typically arises when cache keys are derived from unvalidated or attacker-controlled inputs and the underlying datastore is used to materialize cached entries. Because Cockroachdb is a distributed SQL database that Adonisjs applications often use for strong consistency and transactional workloads, queries that are cached without strict input validation can propagate tainted results across nodes and requests.

Consider an endpoint that caches user profile data keyed by a user-supplied profileId. If the application uses this value directly to build a cache key (e.g., profile:${profileId}) and then issues a Cockroachdb query such as SELECT * FROM profiles WHERE id = $1, an attacker can supply crafted IDs to force cache entries that reference unintended rows or store malicious metadata. If the cache layer does not enforce strict schema-aware normalization, the poisoned entry may be served to other users who happen to hit the same cache key space, especially when cache namespaces are not properly isolated.

Adonisjs cache bindings often rely on tags or composite keys, and if those keys incorporate user input without canonicalization, two logically distinct requests can map to the same cache entry. With Cockroachdb, long-running serializable transactions may read consistent snapshots; however, if a cached query result is reused beyond its validity window, an attacker who can affect the cache key or value can cause stale or malicious data to persist across transactions. This is exacerbated when the application caches rendered fragments that include sensitive contextual cues (tenant identifiers, locale, permissions) that are not part of the cache key.

Another vector involves query result caching where the application stores rows returned by Cockroachdb and later reuses them without re-evaluating authorization. For example, if a cached row set includes an isAdmin flag that is later elevated by an admin in Cockroachdb, the cached version will not reflect the change until expiry, allowing a privilege escalation scenario. Because Cockroachdb supports complex joins and secondary indexes, developers may cache broader result sets to reduce latency; if those sets are keyed weakly, an attacker can manipulate parameters to expand the cached dataset and exfiltrate or poison more data.

LLM/AI Security checks included in middleBrick are relevant here because prompt injection or unsafe consumption patterns in AI features can lead to generated cache keys or values that incorporate attacker-controlled content, further expanding the poisoning surface. middleBrick detects such patterns and maps findings to frameworks like OWASP API Top 10 to highlight cache poisoning risks in API security reports.

To mitigate cache poisoning when using Cockroachdb with Adonisjs, enforce strict input validation, canonicalize cache keys, and isolate cache namespaces by tenant and context. Below are concrete patterns and code examples.

1. Validate and sanitize all identifiers used in cache keys

Ensure that any user input used in cache keys is validated against an allowlist or strict pattern. For identifiers, enforce UUID or integer formats and reject unexpected characters.

import { schema } from '@ioc:Adonis/Core/Validator'
import Cache from '@ioc:Adonis/Addons/LucidCache'

const profileSchema = schema.create({
  profileId: schema.string({}, [rules.uuid()])
})

export async function getProfile(ctx) {
  const validated = await validator.validate({ schema: profileSchema, data: ctx.request.params() })
  const key = `profile:${validated.profileId}`
  const cached = await Cache.store('default').get(key)
  if (cached) return cached
  const row = await db.query('SELECT * FROM profiles WHERE id = $1', [validated.profileId])
  await Cache.store('default').put(key, row, 300)
  ctx.response.send(row)
}

2. Use tenant-aware cache keys to prevent cross-tenant poisoning

When Cockroachdb hosts multitenancy via a tenant_id column, include the tenant in the cache key and avoid caching across tenants.

export async function getTenantData(ctx) {
  const tenantId = ctx.auth.user?.tenantId
  const key = `tenant:${tenantId}:profile:${validated.profileId}`
  const cached = await Cache.store('default').get(key)
  if (cached) return cached
  const row = await db.query(
    'SELECT * FROM profiles WHERE id = $1 AND tenant_id = $2',
    [validated.profileId, tenantId]
  )
  await Cache.store('default').put(key, row, 300)
  ctx.response.send(row)
}

3. Parameterize queries and avoid caching raw result sets that include sensitive flags

Do not cache entries that include mutable authorization attributes. If caching is necessary, store only non-sensitive fields and re-check permissions on each request.

export async function getPublicProfile(ctx) {
  const key = `public:profile:${validated.profileId}`
  const cached = await Cache.store('default').get(key)
  if (cached) return cached
  const row = await db.query(
    'SELECT id, name, avatar_url, created_at FROM profiles WHERE id = $1',
    [validated.profileId]
  )
  // Do not cache isAdmin or role fields
  await Cache.store('default').put(key, row, 300)
  ctx.response.send(row)
}

4. Set explicit TTLs and use cache versioning for data that changes

When underlying Cockroachdb data is updated frequently, use versioned keys or short TTLs to reduce the window where poisoned data can be served.

const row = await db.query('SELECT * FROM profiles WHERE id = $1', [validated.profileId])
const version = row.updatedAt ? new Date(row.updatedAt).getTime() : Date.now()
const key = `profile:${validated.profileId}:v${version}`
await Cache.store('default').put(key, row, 60)

5. Prefer parameterized statements and avoid string interpolation in queries cached by key

Always use placeholders ($1, $2) with Cockroachdb drivers to ensure inputs are treated as values, not executable fragments. This prevents injection that could manipulate cache behavior indirectly.

// Correct: parameterized
await db.query('SELECT * FROM sessions WHERE user_id = $1 AND expires > NOW()', [userId])

// Avoid: string interpolation that may affect cache key construction
// await db.query(`SELECT * FROM sessions WHERE user_id = ${userId}`)

6. Use middleBrick scans to detect cache-related risks

Run middleBrick against your API endpoints to uncover cache poisoning indicators such as missing input validation, weak cache key construction, and exposed internal errors. The scanner maps findings to OWASP API Top 10 and provides remediation guidance without requiring agents or credentials.