Credential Stuffing in Fiber with Cockroachdb

Credential stuffing is an automated brute-force technique that relies on lists of known username and password pairs to gain unauthorized access. When an API built with Fiber uses CockroachDB as its backend, the interaction between session handling, database queries, and authentication logic can unintentionally support or amplify this attack surface.

Consider a typical login flow in Fiber where a POST request hits an endpoint such as /login. The handler reads a username and password, queries CockroachDB to find a matching user, and then issues a session cookie or JWT. If the endpoint lacks rate limiting, an attacker can submit thousands of credential pairs per minute from distributed IPs. Even though CockroachDB is strongly consistent and resilient, the database itself does not prevent high-volume query floods; the application must enforce request throttling.

Additionally, error handling choices can leak information. If the Fiber handler returns different HTTP status codes or response bodies for "user not found" versus "incorrect password," an attacker learns which usernames are valid. Combined with predictable or reused passwords from prior breaches, this accelerates successful credential stuffing. Insecure storage of credentials in CockroachDB, such as plaintext passwords or weak hashing, further lowers the barrier for attackers who may obtain database access through other means.

SSRF and unsafe consumption risks can compound the problem. If the API accepts URLs or hostnames that the server then queries, an attacker might coerce the service into reaching into the CockroachDB admin UI or internal SQL ports. Meanwhile, insecure LLM endpoints or unchecked input fields may allow injection-style payloads that modify SQL behavior or session logic, making it easier to test credential combinations at scale.

middleBrick scans such APIs using 12 parallel checks, including Authentication, Input Validation, Rate Limiting, and SSRF, to detect weak spots in this exact configuration. It flags missing rate controls, verbose errors, and weak storage practices, providing prioritized findings with severity levels and remediation guidance to help teams harden the Fiber + CockroachDB stack.

To reduce credential stuffing risk, enforce strict rate limiting at the Fiber level and ensure database interactions do not divulge useful information. Below are concrete, syntactically correct examples that demonstrate secure patterns.

First, use a middleware-based rate limiter in Fiber to restrict login attempts per IP or per user identifier. This example uses a token bucket approach with a map to track timestamps, keeping logic simple and effective.

package main

import (
	"net/http"
	"time"

	"github.com/gofiber/fiber/v2"
)

type RateLimiter struct {
	visits map[string][]time.Time
	limit  int
	window time.Duration
}

func NewRateLimiter(limit int, window time.Duration) *RateLimiter {
	return &RateLimiter{
		visits: make(map[string][]time.Time),
		limit:  limit,
		window: window,
	}
}

func (rl *RateLimiter) Allow(ip string) bool {
	ts := time.Now()
	tail := ts.Add(-rl.window)
	visits := rl.visits[ip]
	i := 0
	for _, t := range visits {
		if t.After(tail) {
			visits[i] = t
			i++
		}
	}
	visits = visits[:i]
	if len(visits) >= rl.limit {
		return false
	}
	visits = append(visits, ts)
	rl.visits[ip] = visits
	return true
}

func main() {
	app := fiber.New()
	rl := NewRateLimiter(5, time.Minute)

	app.Post("/login", func(c *fiber.Ctx) error {
		ip := c.IP()
		if !rl.Allow(ip) {
			return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{"error": "too many requests"})
		}

		var cred struct {
			Username string `json:"username"`
			Password string `json:"password"`
		}
		if err := c.BodyParser(&cred); err != nil {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request"})
		}

		// Securely query CockroachDB using parameterized statements
		var storedHash string
		err := db.QueryRow("SELECT password_hash FROM users WHERE username = $1", cred.Username).Scan(&storedHash)
		if err != nil {
			// Return generic message to avoid user enumeration
			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "invalid credentials"})
		}

		// Compare hashed password with constant-time comparison
		if !compareHash(cred.Password, storedHash) {
			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "invalid credentials"})
		}

		// Issue secure session cookie
		cookie := &fiber.Cookie{
			Name:     "session",
			Value:    generateSessionToken(),
			Expires:  time.Now().Add(24 * time.Hour),
			HTTPOnly: true,
			Secure:   true,
			SameSite: fiber.CookieSameSiteStrictMode,
		}
		c.Cookie(cookie)
		return c.SendStatus(fiber.StatusOK)
	})

	app.Listen(":3000")
}

func compareHash(input, stored string) bool {
	// Use a constant-time comparison function in production
	return input == stored // placeholder
}

Second, ensure CockroachDB credentials are stored and queried safely. Use parameterized SQL to avoid injection and avoid returning detailed errors to clients. The following snippet shows a secure query pattern that works with CockroachDB’s PostgreSQL wire protocol.

import (
	"database/sql"
	_ "github.com/lib/pq"
)

const (
	connStr = "postgresql://user:password@host:26257/dbname?sslmode=require"
)

func getUserByUsername(db *sql.DB, username string) (string, error) {
	var hash string
	// Parameterized query prevents SQL injection and works well with CockroachDB
	row := db.QueryRow("SELECT password_hash FROM users WHERE username = $1", username)
	err := row.Scan(&hash)
	return hash, err
}

Third, enable simple audit logging to detect repeated failures for the same user without exposing details. This helps identify potential stuffing campaigns while keeping error responses generic.

func logFailedAttempt(ip, username string) {
	// Insert into a CockroachDB audit table using parameterized queries
	_, err := db.Exec("INSERT INTO auth_audit(attempt_ip, username, ts) VALUES($1, $2, now())", ip, username)
	if err != nil {
		// handle error silently to avoid information leakage
	}
}

By combining rate limiting, generic error messages, and parameterized database queries, the Fiber application reduces the effectiveness of credential stuffing while maintaining compatibility with CockroachDB’s strong consistency and SQL semantics.