Credential Stuffing in Chi with Firestore

Credential stuffing is a volume-based attack where attackers use lists of breached username and password pairs to gain unauthorized access to user accounts. In Chi, a backend for Firebase, using Firestore as the identity store without additional protections can unintentionally amplify this risk. When authentication endpoints rely only on email and password checks against Firestore documents and do not enforce strong rate limiting or anomaly detection, attackers can automate requests that appear like normal login attempts.

Firestore rules are designed for data access control, not authentication enforcement. If rules permit read or write access based solely on matching email fields without proof of legitimate credentials, credential stuffing probes can iterate through accounts efficiently. For example, an attacker may send many login requests using different email addresses, and if each request results in a distinct Firestore document read, the scan can map which accounts exist without triggering defenses.

The absence of per-user or per-IP rate limiting allows attackers to run thousands of attempts in a short period. Even though Firestore has quotas, attackers can stay within those limits by pacing requests or using distributed sources. Because Chi routes requests through Firestore security rules, missing protections such as account lockout, CAPTCHA, or suspicious behavior detection make the system more susceptible to successful credential stuffing.

During a scan, middleBrick tests authentication by attempting logins with known bad credentials and observing response differences. If a 200 response with user data is returned for valid-looking emails, and 403 or 404 responses differ only by account existence, this discrepancy becomes an account enumeration finding. Enumeration enables attackers to build targeted lists for further credential stuffing campaigns.

Additionally, Firestore indexes can accelerate enumeration when queries are structured predictably. If your application queries users by email in a way that returns distinct success or error states, attackers can infer valid accounts. MiddleBrick’s authentication checks correlate these patterns with Firestore rule configurations to highlight exposures that facilitate credential stuffing in Chi.

Remediation focuses on reducing information leakage, enforcing rate controls at the application layer, and hardening Firestore rules to avoid exposing account existence. Implement consistent response shapes and status codes for all authentication outcomes so attackers cannot distinguish between valid and invalid accounts.

Use a constant-time comparison for credentials and return the same generic message regardless of whether the email exists. Enforce rate limiting by user identity and IP address using a backend service or Cloud Functions, since Firestore rules cannot perform fine-grained rate tracking.

When possible, avoid querying Firestore by email directly in client-accessible rules. Instead, use a mapping of user IDs to hashed credentials or integrate with a dedicated authentication provider. If you must keep email-based lookups, add randomness to query patterns and ensure rules do not reveal document existence through read permissions.

Example Firestore security rules that avoid leaking account existence:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow read access only to the authenticated user's own document by UID
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
    // Block public enumeration by disallowing queries that expose user documents
    match /users/{userId}/public {
      allow read: if false;
    }
  }
}

Example Chi route that returns a uniform response for login attempts:

import { NextRequest, NextResponse } from 'next/server';
import { getFirestore, doc, getDoc } from 'firebase/firestore';
import { compareSync } from 'bcrypt';

export async function POST(request: NextRequest) {
  const { email, password } = await request.json();
  const db = getFirestore();
  const usersRef = doc(db, 'users', email); // or use a UID-based reference
  const snap = await getDoc(usersRef);

  const fakeHash = '$2b$10$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'; // constant fake hash
  const isValid = snap.exists() ? compareSync(password, snap.data()?.passwordHash) : false;

  // Always return the same shape and generic message
  if (isValid) {
    return NextResponse.json({ success: true, userId: snap.id });
  } else {
    return NextResponse.json({ success: false, message: 'Invalid credentials' });
  }
}

Implement rate limiting using a server-side store such as Redis or Firestore itself with timestamps to track attempts per user and IP. Avoid relying only on Firestore rules for this purpose. Combine these measures with CAPTCHA challenges after suspicious patterns detected by middleBrick’s authentication and rate limiting checks.

MiddleBrick’s scans can validate these changes by checking response consistency and rule strictness. The Pro plan’s continuous monitoring can alert you if new endpoints introduce enumeration or missing rate controls, helping maintain a strong security posture for Chi and Firestore integrations.