Credential Stuffing in Feathersjs with Dynamodb

Credential stuffing is an automated brute-force technique that relies on lists of known username and password pairs to gain unauthorized access. When using Feathersjs with DynamoDB as the user store, several implementation patterns can inadvertently expose the application to this attack vector.

Feathersjs does not enforce authentication by default; it expects developers to add authentication via services and hooks. If a developers configure a authentication hook without strict rate controls and without tying it to DynamoDB conditional checks, the service endpoint becomes a target for credential stuffing.

DynamoDB itself does not introduce credential stuffing, but its usage patterns in Feathersjs can amplify risk. For example, querying by email (or username) without enforcing per-identifier attempt limits allows an attacker to iterate over user accounts without triggering account lockout. Because DynamoDB charges per request, naive implementations may not throttle requests aggressively, making automated, low-and-slow attacks economically feasible.

A typical vulnerable Feathersjs service setup uses the @feathersjs/authentication local strategy with a custom users service that queries DynamoDB via an adapter. If the adapter’s find or get methods do not enforce strict input validation and rate-limiting hooks, an attacker can submit thousands of password guesses per minute across many accounts, avoiding per-account lockouts.

Additional risk arises from inconsistent error responses. If a Feathersjs endpoint returns different HTTP status codes or message bodies for "user not found" versus "incorrect password," an attacker can enumerate valid usernames. When combined with DynamoDB queries that are not constant-time or that leak existence via timing differences, this enables reconnaissance that facilitates credential stuffing.

Real-world attack patterns seen in the wild include the use of credential lists from known breaches (e.g., HaveIBeenPwned collections) to test accounts on Feathersjs APIs that lack MFA, suspicious IP detection, or adaptive throttling. In such scenarios, DynamoDB streams or CloudWatch metrics may not be configured to detect rapid authentication failures, delaying incident response.

To mitigate credential stuffing in this stack, developers must implement layered defenses: strict rate limiting at the Feathersjs hooks layer, robust input validation, consistent error messaging, and monitoring of DynamoDB consumed capacity for anomalies. MiddleBrick’s LLM/AI Security checks and credential stuffing-specific scans can identify whether your OpenAPI spec and runtime behavior expose authentication endpoints to bulk guessing attacks.

Remediation centers on hardening the authentication flow and DynamoDB access patterns in Feathersjs. Use constant-time comparison where possible, enforce rate limits per user and per IP, and ensure errors do not disclose user existence.

1. Consistent error handling

Ensure your authentication hook returns the same generic message regardless of whether the user exists. This prevents username enumeration used in credential stuffing.

// src/hooks/authentication-hook.js
module.exports = function authenticationHook(options = {}) {
  return async context => {
    const { email, password } = context.data;
    // Always perform a dummy fetch to keep timing similar
    const userService = context.app.service('users');
    const users = await userService.Model.scan('email-index')
      .where('email').equals(email)
      .limit(1)
      .using(context.app.get('dynamodb'))
      .load();
    const user = users[0];
    // Simulate password hashing/checking even if user not found
    const dummyHash = '$2b$10$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';
    const isValid = user ? await comparePassword(password, user.passwordHash) : await comparePassword(password, dummyHash);
    if (!isValid) {
      throw new Error('Invalid credentials');
    }
    // Attach user to context if needed
    context.result = { userId: user ? user.userId : null };
    return context;
  };
};

async function comparePassword(plain, hashed) {
  // Use your bcrypt or argon2 library here
  return true; // placeholder
}

2. Rate limiting per user and IP in hooks

Integrate a lightweight rate limiter at the hook level to restrict attempts per identifier and source IP. This reduces the effectiveness of distributed credential stuffing campaigns.

// src/hooks/rate-limit-hook.js
const rateLimitMap = new Map();

module.exports = function rateLimitHook(options = {}) {
  return async context => {
    const { email, ip } = context.data;
    const key = email || ip;
    const now = Date.now();
    const windowMs = 60 * 1000; // 1 minute
    const maxAttempts = 5;

    if (!rateLimitMap.has(key)) {
      rateLimitMap.set(key, []);
    }
    const attempts = rateLimitMap.get(key).filter(timestamp => now - timestamp < windowMs);
    if (attempts.length >= maxAttempts) {
      throw new Error('Too many attempts. Try again later.');
    }
    attempts.push(now);
    rateLimitMap.set(key, attempts);
    return context;
  };
};

3. Secure DynamoDB queries with parameterized expressions

Always use expression attribute values to avoid injection and ensure predictable query patterns. This keeps access patterns consistent and simplifies monitoring.

// src/services/users/users-model.js
const AWS = require('aws-sdk');
const dynamo = new AWS.DynamoDB.DocumentClient();

async function getUserByEmail(email) {
  const params = {
    TableName: process.env.USERS_TABLE,
    IndexName: 'email-index',
    KeyConditionExpression: 'email = :emailVal',
    ExpressionAttributeValues: {
      ':emailVal': email
    },
    Limit: 1
  };
  const data = await dynamo.query(params).promise();
  return data.Items[0] || null;
}

module.exports = { getUserByEmail };

4. Enforce password policies and MFA

Strong password policies reduce the effectiveness of leaked credential lists. Where possible, integrate multi-factor authentication to add a layer independent of passwords.

5. Monitoring and anomaly detection

Instrument your Feathersjs app and DynamoDB to emit metrics on authentication failures. Alert on spikes in failures per user or IP to detect ongoing credential stuffing campaigns early.

MiddleBrick’s dashboard and CLI can scan your Feathersjs + DynamoDB setup to surface authentication weaknesses and mapping to frameworks like OWASP API Top 10 and PCI-DSS. The Pro plan enables continuous monitoring so future configuration changes do not reintroduce these risks.