Cache Poisoning in Hapi with Cockroachdb

Cache poisoning occurs when an attacker manipulates cached data so that malicious or incorrect responses are served to users. In a Hapi application using Cockroachdb as the backend data store, this typically arises from improper cache key construction or insufficient validation of cached responses, combined with Cockroachdb behavior around distributed transactions and schema exposure.

Hapi does not enforce a cache layer by default; developers often introduce caching via plugins or route extensions that use keys derived from request parameters, query strings, or user identifiers. If these keys include unvalidated input—such as a user-supplied accountId or productId—an attacker can craft inputs that map to the same cache entry as another user’s data. Cockroachdb’s distributed SQL layer preserves strong consistency for reads within a transaction, but it does not automatically isolate cached representations from logical data views. An attacker who can influence the cache key may cause a victim’s sensitive query results to be stored under a key the attacker can later request.

Another vector involves response caching on the server side. If a Hapi route that queries Cockroachdb caches HTTP responses based on URL and query parameters without normalizing or validating inputs, an attacker can submit requests designed to overwrite cached entries. For example, a route like /api/users/{id} that caches based on id could allow an attacker to overwrite the cached representation for a high-privilege user ID with their own ID, provided the application incorrectly shares cache namespaces across users.

Moreover, schema exposure through error messages or introspection endpoints can aid an attacker in refining cache poisoning attempts. If Cockroachdb returns detailed constraint violations or type mismatches, an attacker can learn about column names and types to craft inputs that exploit weak cache key designs. Because Cockroachdb supports PostgreSQL wire protocol, applications that inadvertently treat database errors as safe cacheable content increase the risk of information leakage that can be leveraged to refine poisoning strategies.

To illustrate, consider a Hapi route that builds a cache key directly from query parameters without normalization:

const Hapi = require('@hapi/hapi');
const init = async () => {
  const server = Hapi.server({ port: 4000 });
  server.route({
    method: 'GET',
    path: '/api/data',
    handler: async (request) => {
      const { category, userId } = request.query;
      const cacheKey = `data:${category}:${userId}`;
      // pseudo-cache lookup/store
      let cached = cache.get(cacheKey);
      if (!cached) {
        const client = new Client({ connectionString: 'postgresql://...' });
        await client.connect();
        const res = await client.query('SELECT * FROM data WHERE category = $1 AND user_id = $2', [category, userId]);
        cached = res.rows;
        cache.set(cacheKey, cached);
        await client.end();
      }
      return cached;
    }
  });
  await server.start();
};
init();

In this example, if category or userId are not strictly validated and are used verbatim in the cache key, an attacker can supply values that collide with legitimate users’ keys. Cockroachdb will return the correct rows for the supplied query, but the cached result may be reused across different contexts, effectively poisoning the cache for other users.

Remediation focuses on strict input validation, cache key isolation, and avoiding caching of user-specific or sensitive data unless explicitly designed. Below are concrete code examples that demonstrate secure patterns for a Hapi service using Cockroachdb.

1. Validate and normalize inputs before constructing cache keys

Ensure that all inputs used in cache keys are constrained to expected formats. For identifiers, use UUID validation or integer checks. Avoid concatenating raw query parameters directly into cache keys.

const Joi = require('joi');
const validateInput = (query) => {
  const schema = Joi.object({
    category: Joi.string().valid('books', 'electronics', 'clothing').required(),
    userId: Joi.string().pattern(/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/).required()
  });
  return schema.validate(query);
};

2. Isolate cache namespaces per user or tenant

Do not share cache keys across users. Include a tenant or user-specific segment that is derived from authenticated context rather than from raw request input.

server.route({
  method: 'GET',
  path: '/api/data',
  handler: async (request) => {
    const { category } = request.query;
    const userId = request.auth.credentials.id; // authenticated user ID
    const cacheKey = `user:${userId}:data:${category}`;
    // cache operations using the isolated key
    let cached = cache.get(cacheKey);
    if (!cached) {
      const client = new Client({ connectionString: 'postgresql://...' });
      await client.connect();
      const res = await client.query('SELECT * FROM data WHERE category = $1 AND user_id = $2', [category, userId]);
      cached = res.rows;
      cache.set(cacheKey, cached);
      await client.end();
    }
    return cached;
  }
});

3. Avoid caching sensitive or mutable responses

Responses that contain private data or are subject to frequent change should not be cached. Use cache-control headers or bypass caching logic for such routes.

server.route({
  method: 'GET',
  path: '/api/private',
  handler: async (request) => {
    const client = new Client({ connectionString: 'postgresql://...' });
    await client.connect();
    const res = await client.query('SELECT * FROM sensitive WHERE user_id = $1', [request.auth.credentials.id]);
    await client.end();
    // explicitly avoid caching
    request.response.header('Cache-Control', 'no-store');
    return res.rows;
  }
});

4. Use parameterized queries and error suppression

Prevent error-based information leakage by using parameterized queries and avoiding detailed database errors in responses. Map database errors to generic messages before returning to the client.

try {
  const client = new Client({ connectionString: 'postgresql://...' });
  await client.connect();
  const res = await client.query('SELECT * FROM data WHERE category = $1 AND user_id = $2', [category, userId]);
  await client.end();
  return res.rows;
} catch (err) {
  // Log detailed error internally
  console.error(err);
  throw new Error('Internal server error');
}

These practices reduce the surface for cache poisoning by ensuring that cache keys are predictable, isolated, and derived from trusted sources, while Cockroachdb interactions remain secure and focused on data integrity.