Credential Stuffing in Feathersjs with Api Keys

Credential stuffing is an automated attack where valid credentials from one breach are systematically reused against a target application to gain unauthorized access. When an API built with FeathersJS relies on API keys as the primary authentication mechanism without additional protections, it can become an attractive target for credential stuffing. Unlike session-based web applications, many FeathersJS APIs are designed as stateless services that authenticate each request independently, which can simplify reuse by attackers.

The risk pattern emerges when API keys are:

• Long-lived and rarely rotated, increasing the exposure window if leaked.
• Stored or transmitted insecurely, such as in client-side JavaScript, mobile apps, or logs.
• Used without rate limiting or request throttling, allowing automated tools to submit thousands of attempts per minute.
• Validated with permissive matching logic that does not tightly scope keys to specific services or contexts.

FeathersJS applications often expose REST or socket endpoints that accept an API key via headers (e.g., Authorization: ApiKey <key>). If the service does not enforce strict origin checks, request fingerprinting, or anomaly detection, an attacker can automate credential stuffing against these endpoints using leaked key lists. A successful hit might expose sensitive data, trigger business logic flaws (such as unauthorized service actions), or provide a foothold for further attacks like BOLA/IDOR if the key is tied to a specific user or tenant.

Because FeathersJS can integrate with multiple transports (REST, Socket.io, GraphQL), credential stuffing against API keys can manifest differently across transports. For example, a REST endpoint may return distinct HTTP status codes that help an attacker refine their campaign, while a socket-based service might reveal timing differences or error patterns. The unauthenticated attack surface scanned by middleBrick can surface these endpoints and highlight whether public interfaces accept API keys without sufficient controls.

In a real-world scenario, an attacker might use a list of compromised keys against a public /users endpoint to enumerate valid accounts or infer organizational structures. If the API lacks robust rate limiting and does not enforce per-key quotas, the credential stuffing campaign can proceed undetected, violating the principle of secure default configurations recommended by OWASP API Security Top 10.

middleBrick scans such public endpoints for authentication weaknesses and flags whether API key usage appears without complementary protections like rate limiting or input validation. The tool evaluates the unauthenticated attack surface and reports findings aligned with compliance frameworks, helping teams understand how their API surface may be abused through automated credential reuse.

Mitigating credential stuffing when using API keys in FeathersJS requires defense-in-depth: strict key management, transport security, and runtime protections. Below are concrete, actionable code examples that you can apply in a FeathersJS service to reduce risk.

1. Enforce HTTPS and validate key format

Ensure your API only accepts keys over TLS and validates key format to prevent malformed or leaked values from being processed.

// src/hooks/validate-api-key.hooks.js
module.exports = {
  before: {
    all: [],
    find: [ validateApiKey ],
    get: [ validateApiKey ],
    create: [ validateApiKey ],
    update: [ validateApiKey ],
    patch: [ validateApiKey ],
    remove: [ validateApiKey ]
  },
  after: {},
  error: {}
};

function validateApiKey(context) {
  const { headers } = context.params;
  const provided = headers && headers.authorization;
  if (!provided || !/^ApiKey\\s[\\w\\-]+$/.test(provided)) {
    throw new Error('Unauthorized: Invalid API key format');
  }
  // Optionally normalize header for downstream services
  context.params.apiKey = provided.split(' ')[1];
  return context;
}

2. Bind keys to tenant or service scope

Avoid using global keys. Instead, map each key to a scoped record and enforce scope checks in your service logic.

// src/services/keys/keys.class.js
const { Service } = require('feathersjs-sequelize');
class KeyService extends Service {
  async get(id, params) {
    const record = await super.get(id, params);
    // Ensure key is active and scoped correctly
    if (record.revoked || record.expires < new Date()) {
      throw new Error('Unauthorized: Key revoked or expired');
    }
    return record;
  }
}

// In your service setup (src/app.js)
const { KeyService } = require('./keys.keys');
app.use('/keys', new KeyService({
  Model: require('./keys.model'),
  paginate: { default: 10, max: 50 }
}));

3. Add rate limiting per API key

Use a middleware or hook to enforce per-key request quotas, making credential stuffing impractical.

// src/hooks/rate-limit.hooks.js
const RedisStore = require('rate-limiter-flexible').RateCheckerRedis;
const redisClient = require('redis').createClient({ url: process.env.REDIS_URL });

const rateLimiter = new RedisStore({
  storeClient: redisClient,
  keyPrefix: 'ratelimit_apikey',
  points: 100, // 100 requests
  duration: 60 // per 60 seconds
});

module.exports = {
  before: {
    all: [ async context => {
      const key = context.params.apiKey;
      if (!key) throw new Error('Unauthorized: Missing API key');
      try {
        await rateLimiter.consume(key);
      } catch (rej) {
        throw new Error('Too Many Requests: Rate limit exceeded');
      }
      return context;
    } ]
  }
};

4. Rotate keys and audit usage

Implement key rotation and log usage to detect anomalies. FeathersJS hooks can attach metadata for downstream auditing.

// src/hooks/audit.hooks.js
module.exports = {
  after: {
    all: [ async context => {
      const { apiKey, user } = context.params;
      // Send to your logging/monitoring backend
      console.info('api_key_usage', { apiKey, path: context.path, method: context.method, timestamp: new Date().toISOString() });
      return context;
    } ]
  }
};

5. Apply complementary runtime protections

Combine API key usage with other controls such as strict CORS, anomaly detection on request patterns, and input validation to reduce the effectiveness of automated campaigns.

middleBrick can help you verify these measures by scanning your public endpoints and identifying whether API keys are exposed without rate limiting or proper validation. Its findings map to frameworks such as OWASP API Top 10 and can guide your remediation efforts.