Credential Stuffing in Adonisjs with Cockroachdb

Credential stuffing is an automated attack where previously breached username and password pairs are reused to gain unauthorized access. When an AdonisJS application uses CockroachDB as its primary data store, the interaction between the ORM, session handling, and the database can unintentionally support or amplify this attack surface.

AdonisJS relies on session cookies and, optionally, token-based mechanisms to maintain authentication. If rate limiting is not enforced on authentication endpoints, an attacker can submit a large volume of credential pairs against the login route. CockroachDB, while providing strong consistency and distributed resilience, does not inherently prevent high-frequency requests to the same user rows. Without explicit protections, an attacker can perform thousands of attempts per minute, relying on weak passwords or password reuse across services.

The ORM layer in AdonisJS typically abstracts queries, but improper usage can introduce issues. For example, if login queries do not enforce strict query constraints or if error messages differ significantly between "user not found" and "invalid password," an attacker can enumerate valid usernames. This user enumeration enables more efficient credential stuffing campaigns. CockroachDB stores data across distributed nodes; while this improves availability, it also means that poorly indexed login queries can become performance bottlenecks, encouraging developers to bypass best practices such as prepared statements or query sanitization.

Session management further compounds the risk. If session identifiers are predictable or if the session cookie lacks the Secure and HttpOnly flags, intercepted credentials can lead to session hijacking. CockroachDB may store session data in a relational table, but if the application does not rotate session identifiers after login or does not invalidate sessions on logout, stolen credentials remain useful for extended periods.

Compliance mappings highlight the severity: credential stuffing often violates OWASP API Top 10 (2023) section 7:2023 – Broken Authentication, and may intersect with PCI-DSS requirements if payment data is involved. SOC2 controls around access management also emphasize the need for rate limiting and anomaly detection, which an unprotected AdonisJS + CockroachDB stack may not provide.

Remediation focuses on rate limiting, secure session handling, and robust query patterns. Implement middleware to throttle authentication attempts and ensure consistent, safe database interactions.

Rate Limiting on Authentication Endpoints

Use AdonisJS middleware to enforce request limits. The following example demonstrates a custom rate limiter applied to the login route:

// start/hooks.ts
import { IocResolver } from '@adonisjs/fold'
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export const rateLimiter = {
  async handle(ctx: HttpContextContract, next: () => Promise) {
    const ip = ctx.request.ip()
    const key = `rate_limit:login:${ip}`
    const existing = await ctx.container.use('Cache').get(key, 0)
    if (existing >= 10) {
      ctx.response.status(429).send({ error: 'Too many requests' })
      return
    }
    await ctx.container.use('Cache').put(key, existing + 1, 60)
    await next()
  }
}

Register this middleware in start/routes.ts and apply it to the login route:

// start/routes.ts
import Route from '@ioc:Adonis/Core/Route'
import { rateLimiter } from 'App/Hooks/rateLimiter'

Route.post('login', 'AuthController.login').middleware(rateLimiter)

Secure Login Query with CockroachDB

Use parameterized queries to prevent SQL injection and ensure consistent error handling. The following AdonisJS controller uses the Lucid ORM to safely validate credentials:

// app/Controllers/Http/AuthController.ts
import { schema } from '@ioc:Adonis/Core/Validator'
import User from 'App/Models/User'
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default class AuthController {
  public async login({ request, auth, response }: HttpContextContract) {
    const loginSchema = schema.create({
      email: schema.string({ trim: true, normalize: true }),
      password: schema.string()
    })

    const validated = await request.validate({ schema: loginSchema })
    const user = await User.query()
      .where('email', validated.email)
      .preload('roles')
      .first()

    if (!user) {
      // Use a consistent error message and delay to deter enumeration
      await new Promise((resolve) => setTimeout(resolve, 1000))
      return response.unauthorized({ error: 'Invalid credentials' })
    }

    const passwordMatch = await user.verifyPassword(validated.password)
    if (!passwordMatch) {
      await new Promise((resolve) => setTimeout(resolve, 1000))
      return response.unauthorized({ error: 'Invalid credentials' })
    }

    // Rotate session identifier to prevent fixation
    await auth.use('web').generate()

    return response.ok({ token: await auth.generate('web') })
  }
}

CockroachDB Schema and Indexing Considerations

Ensure the user table is properly indexed to support efficient lookups without leaking timing information:

-- SQL executed via AdonisJS migration
CREATE TABLE users (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  email STRING UNIQUE NOT NULL,
  password_hash STRING NOT NULL,
  created_at TIMESTAMPTZ DEFAULT now()
);

-- Index on email for fast, consistent lookups
CREATE INDEX idx_users_email ON users (email);

Additionally, configure session storage to use CockroachDB safely:

// config/session.ts
import { SessionConfig } from '@ioc:Adonis/Addons/Session'

const sessionConfig: SessionConfig = {
  driver: 'cockroachdb',
  connection: {
    table: 'sessions',
    host: 'cockroachdb.example.com',
    port: 26257,
    database: 'app_db',
    user: 'app_user',
    password: process.env.DB_PASSWORD
  },
  key: 'sess',
  secure: true,
  httpOnly: true,
  sameSite: 'lax'
}

export default sessionConfig

These measures reduce the effectiveness of credential stuffing by limiting request volume, obscuring user enumeration, and ensuring that database interactions follow secure patterns.