Cache Poisoning in Loopback with Hmac Signatures

Cache poisoning in Loopback applications that rely on Hmac Signatures for request authentication can occur when an attacker causes a cached response to be stored under a key that includes attacker-controlled input, such as a user ID or hostname derived from a forged signature. Loopback applications often use caching layers (e.g., Redis or in-memory caches) to store authenticated responses keyed by request properties. If the cache key incorporates values from the Hmac Signature without strict validation, an attacker who can influence the signed payload or the keying data may poison the cache for subsequent users.

Consider a Loopback endpoint that caches user profile data and uses the Hmac Signature to verify request integrity. If the signature is computed over a subset of request parameters and the cache key includes the subject claim or a hostname without normalizing or validating the signature context, an attacker might submit a request with a valid Hmac Signature but a malicious host or sub value. The application verifies the signature, serves a response, and caches it under the attacker-influenced key. Later, a legitimate user with the same key receives the poisoned response, potentially seeing modified data or executing unintended logic.

This pattern intersects with the broader LLM/AI Security capabilities of middleBrick, which actively probes for system prompt leakage and output anomalies that could indicate cache misuse. middleBrick scans such endpoints and flags items like Unsafe Consumption and Data Exposure, providing prioritized findings with severity and remediation guidance. The scanner also checks whether endpoints with Hmac Signatures are unauthenticated or improperly scoped, which can exacerbate cache poisoning by allowing unsigned or weakly validated requests to influence cached content.

Real-world attack patterns like those in the OWASP API Top 10 and CWE-444 (Uncontrolled Resource Consumption) are relevant. For example, an attacker might exploit weak signature scope to cause cache key collisions, effectively performing a privilege escalation by retrieving another user’s cached data. Because Loopback applications often integrate OpenAPI specs with full $ref resolution, middleBrick cross-references spec definitions with runtime behavior to detect mismatches between declared authentication and actual cache-key derivation.

To remediate cache poisoning when using Hmac Signatures in Loopback, ensure that cache keys are derived from stable, validated request attributes and that signature verification enforces a strict scope. Do not include attacker-influenced data such as raw hostnames or unvalidated user claims in cache keys without canonicalization and signature binding.

Example: secure Loopback middleware that computes an Hmac over selected headers and body fields, then uses a normalized key for caching:

import crypto from 'crypto';
import {Middleware} from '@loopback/core';

const SIGNING_KEY = process.env.SIGNING_KEY || 'replace-with-secure-secret';

export const hmacSignatureMiddleware: Middleware = (req, res, next) => {
  if (req.method === 'GET' && req.url) {
    const parsedUrl = new URL(req.url, `http://${req.headers.host}`);
    const normalizedPath = parsedUrl.pathname;
    const normalizedQuery = new URLSearchParams(parsedUrl.search);
    const payload = `${normalizedPath}?${normalizedQuery}`;
    const hmac = crypto.createHmac('sha256', SIGNING_KEY);
    const signature = hmac.update(payload).digest('hex');
    req.headers['x-hmac-signature'] = signature;
    req.headers['x-hmac-payload'] = payload;
  }
  next();
};

export function buildCacheKey(req: any): string {
  const method = req.method || 'GET';
  const path = req.headers['x-hmac-payload'] || req.path || '/';
  // Include only validated, canonical parts; exclude hostname and raw user claims
  return `cache:${method}:${path}`;
}

Example: verifying the Hmac Signature before using a cached response in a Loopback repository or service:

import crypto from 'crypto';
import {inject} from '@loopback/core';

const SIGNING_KEY = process.env.SIGNING_KEY || 'replace-with-secure-secret';

export class ProfileRepository {
  constructor(@inject('cache.client') private cacheClient: any) {}

  async getProfile(req: any, userId: string) {
    const providedSignature = req.headers['x-hmac-signature'];
    const payload = req.headers['x-hmac-payload'];
    if (!providedSignature || !payload) {
      throw new Error('Missing Hmac Signature');
    }
    const expected = crypto
      .createHmac('sha256', SIGNING_KEY)
      .update(payload)
      .digest('hex');
    if (!crypto.timingSafeEqual(Buffer.from(providedSignature), Buffer.from(expected))) {
      throw new Error('Invalid Hmac Signature');
    }
    const cacheKey = `profile:${userId}`;
    const cached = await this.cacheClient.get(cacheKey);
    if (cached) {
      return JSON.parse(cached);
    }
    // fetch and cache...
    const data = await this.fetchProfile(userId);
    await this.cacheClient.set(cacheKey, JSON.stringify(data), {ttl: 300});
    return data;
  }

  private async fetchProfile(userId: string) {
    // implementation
    return {id: userId, name: 'example'};
  }
}

Additional remediation steps include normalizing query parameters before signing, avoiding cache keys that incorporate hostname or unvalidated user claims, and ensuring that cache entries are scoped per authenticated subject with proper signature binding. middleBrick’s Pro plan supports continuous monitoring and CI/CD integration, which can automatically detect risky caching patterns and enforce consistent signature usage across your API surface.