Credential Stuffing in Rails with Cockroachdb

Credential stuffing is an automated attack where attackers use large lists of breached username and password pairs to gain unauthorized access. When the backend is a Ruby on Rails application using CockroachDB as the database, the risk pattern is similar to other SQL-backed stacks, but specific implementation details can either mitigate or exacerbate the issue.

Rails applications typically rely on ActiveRecord for database interactions. If the authentication logic performs a direct lookup by username or email and compares the provided password with a stored hash without additional protections, an attacker can send many requests using different credentials within a short time window. CockroachDB, being PostgreSQL-wire compatible, behaves like a distributed PostgreSQL instance. This means Rails applications using the standard pg adapter connect to CockroachDB in the same way they would to PostgreSQL. If Rails does not enforce strict rate limiting or lockout mechanisms, the database will process each authentication query independently, and an attacker can iterate over credentials rapidly.

A common vulnerable pattern in Rails controllers is finding a user by email and then checking the password with authenticate (from has_secure_password), which triggers a database query for each attempt. With CockroachDB, because it supports distributed transactions and strong consistency for reads within a cluster, each of these queries completes quickly, allowing many attempts per second if the application does not throttle them. Unlike some databases that may introduce artificial delays under high load, CockroachDB will return results as long as the node is healthy, which can make automated attacks more efficient from the attacker’s perspective.

Another contributing factor is the use of predictable or reused passwords. In credential stuffing campaigns, attackers rely on password reuse across sites. If a Rails app stores passwords weakly or allows common passwords without enforcement, the likelihood of successful matches increases. Additionally, if session tokens or remember-me cookies are not invalidated after failed attempts, attackers might leverage partial successes to maintain access without triggering obvious account lockouts.

While CockroachDB offers features like multi-region resilience and horizontal scalability, these do not inherently protect against application-layer authentication abuse. The database layer will faithfully execute queries, but the surrounding Rails controls must impose safeguards. Without proactive detection or throttling, the combination of a fast, consistent database and an unprotected authentication endpoint creates an environment where credential stuffing can succeed with minimal friction.

Mitigating credential stuffing in a Rails application backed by CockroachDB requires a combination of secure authentication logic, rate limiting, and careful use of database features. Below are concrete code examples using the standard pg adapter, which is compatible with CockroachDB.

1. Secure Authentication with Rate Limiting at the Application Layer

Use rack-attack to limit login attempts per IP or per user. This reduces the number of queries hitting CockroachDB.

# config/initializers/rack_attack.rb
class Rack::Attack
  throttle('logins/ip', limit: 5, period: 60) do |req|
    req.ip if req.path == '/login' && req.post?
  end

  throttle('logins/email', limit: 5, period: 60) do |req|
    req.email if req.path == '/login' && req.post?
  end

  self.throttled_response = lambda do |env|
    [429, {}, ['Too many login attempts. Try again later.']]
  end
end

2. Parameterized Queries to Avoid Injection and Ensure Safe Execution

Always use ActiveRecord parameterized queries or prepared statements. CockroachDB handles these efficiently, and it prevents attackers from manipulating SQL to bypass authentication.

# app/models/user.rb
class User < ApplicationRecord
  has_secure_password validations: false

  # Use find_by with parameterized conditions
  def self.find_for_database_authentication(conditions = {})
    email = conditions[:email]
    return nil if email.blank?
    # This generates a parameterized query safe for CockroachDB
    where(email: email.downcase).first
  end
end

3. Account Lockout with Conditional Updates in CockroachDB

Use an atomic update to increment failure counts and lock accounts when thresholds are exceeded. CockroachDB’s transactional model ensures consistency across distributed nodes.

# app/models/user.rb
class User < ApplicationRecord
  LOCKOUT_THRESHOLD = 5
  LOCKOUT_PERIOD = 30.minutes

  def register_login_failure
    update_lockout_attributes do
      failed_attempts: failed_attempts + 1,
      last_failed_at: Time.current
    end
  end

  def clear_login_attempts
    update_lockout_attributes(failed_attempts: 0, locked_at: nil)
  end

  def lockout_exceeded?
    failed_attempts >= LOCKOUT_THRESHOLD && locked_at > LOCKOUT_PERIOD.ago
  end

  private

  def update_lockout_attributes(attributes)
    # Use a CockroachDB-compatible upsert to avoid race conditions
    self.class.where(id: id).update_all(attributes.merge(updated_at: Time.current))
    reload
  end
end

4. Enforce Strong Password Policies and Uniqueness Checks

Prevent users from choosing common or compromised passwords. Use pwned password checks or a custom dictionary, and enforce uniqueness in a way that works with CockroachDB’s distributed schema.

# app/models/user.rb
class User < ApplicationRecord
  validates :password, length: { minimum: 12 }, if: :password_required?
  validate :password_not_common

  private

  def password_not_common
    # Example using a local list or external API
    common_passwords = %w[123456 password letmein qwerty welcome]
    if common_passwords.include?(password)
      errors.add(:password, 'is too common')
    end
  end
end

5. Use Secure Session Management and Token Rotation

Ensure session cookies are HttpOnly, Secure, and SameSite. Rotate session identifiers after login to prevent session fixation, which can compound the impact of credential stuffing.

# app/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  def create
    user = User.find_for_database_authentication(email: params[:email])
    if user&.authenticate(params[:password])
      user.clear_login_attempts
      reset_session # Rotate session token to prevent fixation
      session[:user_id] = user.id
      redirect_to root_path, notice: 'Logged in successfully'
    else
      user.register_login_failure
      flash.now[:alert] = 'Invalid email or password'
      render :new, status: :unprocessable_entity
    end
  end
end