Credential Stuffing in Flask with Bearer Tokens

Credential stuffing is an automated attack where attackers use large lists of breached username and password pairs to gain unauthorized access. When Flask APIs rely on Bearer tokens for authentication without additional protections, the risk of successful credential stuffing increases in indirect but meaningful ways.

In Flask, developers often use token-based authentication where a Bearer token is passed in the Authorization header (e.g., Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...). If the token issuance endpoint or token validation logic is weak, attackers can leverage credential stuffing to discover valid user accounts and potentially obtain or forge tokens. For example, if a Flask route accepts both traditional username/password login and issues a Bearer token, attackers may brute-force credentials to acquire a valid session token. Even when tokens are properly issued, insufficient account lockout or rate limiting on the login endpoint can allow automated attempts to iterate over credentials without detection.

Another exposure vector arises when Bearer tokens are stored or transmitted insecurely within the Flask application. If tokens are logged, leaked via error messages, or predictable, attackers can pair credential stuffing with token harvesting to escalate their impact. Flask applications that do not enforce strong token entropy, reuse tokens across services, or fail to revoke compromised tokens provide opportunities for attackers to maintain persistence after initial credential compromise. The unauthenticated attack surface of a Flask API—such as public token introspection or debug endpoints—can also be targeted to learn whether stolen credentials result in valid tokens.

Because Flask does not enforce authentication by default, developers must explicitly protect routes. If a developer decorates a route with a custom token check but does not validate the token origin or binding to the user’s credentials, an attacker who obtains a valid username and password via stuffing can use those credentials to request a new token and access protected resources. This highlights the importance of coupling strong authentication mechanisms with robust token lifecycle management in Flask.

Securing Bearer tokens in Flask requires a combination of strong token generation, secure transmission, proper validation, and defense-in-depth strategies to mitigate credential stuffing and token misuse.

Secure Token Issuance

When issuing Bearer tokens in Flask, ensure tokens are long, random, and unguessable. Use a cryptographically secure method to generate tokens and associate them with the correct user and scope. Avoid embedding sensitive information in the token payload unless encrypted. Below is an example of issuing a secure Bearer token after validating user credentials:

import secrets
from flask import Flask, request, jsonify, make_response

app = Flask(__name__)

# In-memory store for demonstration; use a secure database in production
valid_users = {
    "alice": "Super$ecureP@ssw0rd"
}
tokens = {}

@app.route("/login", methods=["POST"])
def login():
    data = request.get_json()
    username = data.get("username")
    password = data.get("password")
    if username in valid_users and valid_users[username] == password:
        token = secrets.token_urlsafe(32)  # 256-bit random token
        tokens[token] = username
        response = make_response(jsonify({"message": "Authenticated"}))
        response.headers["Authorization"] = f"Bearer {token}"
        return response, 200
    return jsonify({"error": "Invalid credentials"}), 401

Token Validation Middleware

Protect sensitive routes by implementing a token validation layer that checks the Bearer token against a trusted store and rejects malformed or missing tokens. This prevents attackers from using guessed or leaked tokens:

from functools import wraps
from flask import request, jsonify

def token_required(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        auth_header = request.headers.get("Authorization")
        if not auth_header or not auth_header.startswith("Bearer "):
            return jsonify({"error": "Missing or invalid token"}), 401
        token = auth_header.split(" ")[1]
        if token not in tokens:  # Replace with secure lookup in production
            return jsonify({"error": "Invalid token"}), 401
        return f(*args, **kwargs)
    return decorated

@app.route("/protected", methods=["GET"])
@token_required
def protected():
    return jsonify({"data": "This is protected"}), 200

Mitigating Credential Stuffing

To reduce the effectiveness of credential stuffing against your Flask authentication flow, enforce rate limiting on login and token issuance endpoints, require multi-factor authentication for sensitive operations, and monitor for abnormal login patterns. Pair these measures with short-lived Bearer tokens and secure token revocation to limit the window of opportunity for attackers.