Credential Stuffing in Fastapi with Cockroachdb

Credential stuffing is an automated attack where attackers use large lists of breached username and password pairs to gain unauthorized access to accounts. When an API is built with Fastapi and backed by Cockroachdb, the risk emerges from a combination of factors: weak authentication controls, predictable or reused credentials, and overly permissive database access patterns. Fastapi, while robust, does not inherently prevent credential stuffing—this depends on how endpoints validate credentials and interact with Cockroachdb.

In a typical Fastapi service using Cockroachdb, authentication often involves a POST endpoint that receives a username and password, queries Cockroachdb to find a matching user, and compares a hashed password. If rate limiting is absent or ineffective, an attacker can send thousands of requests per minute using credential lists, targeting both existing accounts and newly created ones. Cockroachdb’s strong consistency and distributed nature can inadvertently aid attackers when queries are not carefully constrained: for example, an inefficient index on the username column can lead to excessive load, while lack of request throttling allows rapid, parallel attempts.

Another contributing factor is the handling of authentication state. If Fastapi relies solely on session cookies or simple JWTs without additional checks (such as device fingerprinting or step-up authentication), compromised credentials can be reused at scale. Cockroachdb’s SQL interface may also expose subtle timing differences or error messages that help attackers infer valid usernames, especially when error handling is not uniform. The OWASP API Top 10 lists credential stuffing under 'Broken Authentication,' and this risk is amplified when API rate limiting is missing and when authentication logic does not enforce lockouts or progressive delays.

Middleware or background tasks that log authentication attempts may inadvertently create audit trails that assist attackers in refining their lists. Furthermore, if the Fastapi application uses default or common administrative usernames—such as 'admin' or 'test'—these become low-hanging fruit in a stuffing campaign. Even with hashed passwords stored in Cockroachdb, poor password policies or reused credentials across services increase the likelihood of successful compromises.

Because middleBrick scans API endpoints without authentication, it can detect the absence of rate limiting, unusual patterns in authentication request volumes, and potential information leakage in error responses that facilitate username enumeration. The scanner correlates these findings with the API specification and runtime behavior to highlight insecure authentication designs involving Cockroachdb-backed Fastapi services.

To mitigate credential stuffing in a Fastapi application backed by Cockroachdb, implement layered defenses: strict rate limiting, secure password storage, and careful query design. Below are concrete code examples that demonstrate these measures in practice.

1. Secure user lookup and password verification

Use a parameterized query to avoid SQL injection and ensure consistent error handling. Store passwords with a strong adaptive hash such as bcrypt.

from fastapi import Fastapi, HTTPException, Depends
from pymongo import MongoClient
import bcrypt

app = Fastapi()

# Cockroachdb connection string for MongoDB-compatible driver (example)
client = MongoClient("mongodb://localhost:26257/?directConnection=true")
db = client["mydb"]
users = db["users"]

# Ensure index on username for performance and to avoid full collection scans
users.create_index("username", unique=True)

def verify_user(username: str, password: str):
    user = users.find_one({"username": username})
    if user and bcrypt.checkpw(password.encode('utf-8'), user["password_hash"].encode('utf-8')):
        return user
    return None

@app.post("/login")
async def login(username: str, password: str):
    user = verify_user(username, password)
    if not user:
        raise HTTPException(status_code=401, detail="Invalid credentials")
    # issue token or session
    return {"token": "example"}

2. Rate limiting with Fastapi middleware

Apply per-username or per-IP rate limits to slow down automated attacks. This example uses a simple in-memory store for illustration; in production, use Redis or a distributed store coordinated with Cockroachdb.

from fastapi import Request
from starlette.middleware.base import BaseHTTPMiddleware
import time

class RateLimitMiddleware(BaseHTTPMiddleware):
    def __init__(self, app, max_attempts=5, window=60):
        super().__init__(app)
        self.max_attempts = max_attempts
        self.window = window
        self.attempts = {}  # key: (username or ip), value: list of timestamps

    async def dispatch(self, request: Request, call_next):
        if request.url.path == "/login":
            username = request.query_params.get("username") or request.state.get("username", "unknown")
            now = time.time()
            key = f"{request.client.host}:{username}"
            self.attempts.setdefault(key, [])
            self.attempts[key] = [t for t in self.attempts[key] if now - t < self.window]
            if len(self.attempts[key]) >= self.max_attempts:
                raise HTTPException(status_code=429, detail="Too many attempts")
            response = await call_next(request)
            # record attempt on failed auth; simplified
            if response.status_code == 401:
                self.attempts[key].append(now)
            return response
        return await call_next(request)

3. Consistent error responses to avoid username enumeration

Return generic messages regardless of whether the username exists, and introduce small, random delays to reduce timing differences.

import asyncio
import random

@app.post("/login")
async def login(username: str, password: str):
    # Simulate constant-time processing
    await asyncio.sleep(random.uniform(0.05, 0.15))
    user = verify_user(username, password)
    if not user:
        # Always return the same status and message
        raise HTTPException(status_code=401, detail="Invalid credentials")
    return {"token": "example"}

4. Use strong password policies and multi-factor authentication

Enforce minimum length and complexity on user registration. Complement password hashes with TOTP-based MFA to reduce the impact of credential reuse.

from pydantic import BaseModel, validator
import re

class UserCreate(BaseModel):
    username: str
    password: str

    @validator("password")
    def validate_password(cls, v):
        if len(v) < 10:
            raise ValueError("password must be at least 10 characters")
        if not re.search(r"[A-Z]", v) or not re.search(r"[0-9]", v):
            raise ValueError("password must include uppercase and digits")
        return v

By combining these techniques—parameterized Cockroachdb queries, robust hashing, rate limiting, and uniform error handling—you significantly reduce the effectiveness of credential stuffing against a Fastapi service. middleBrick can validate these controls by scanning your API specification and runtime behavior to ensure rate limiting is present and authentication endpoints do not leak information.