Credential Stuffing in Restify with Hmac Signatures

Credential stuffing is an automated attack in which valid credentials from one or more breaches are used to gain unauthorized access to accounts. When a Restify service relies only on Hmac Signatures for request authentication without additional protections, the attack surface shifts but does not disappear.

Hmac Signatures typically bind a request to a secret key by signing a canonical string that includes the HTTP method, path, selected headers, a timestamp, and a nonce. If the server validates the signature but does not enforce strong, incremental protections such as per-request nonces, replay-window tracking, or rate limiting, an attacker can replay captured, valid signed requests at high speed. Because the signature itself remains valid for the included timestamp and nonce, the request appears legitimate to the server.

In a Restify implementation, if the signing process does not tightly couple the signature to a per-user, per-session context (for example, by including a user identifier or session binding in the signed payload), attackers can iterate through breached credential pairs and replay successful authenticated flows without triggering anomalies. Moreover, if timestamp and nonce validation is lax—such as accepting a wide time window or not enforcing monotonic nonces—the attacker can conduct many attempts within the allowed bounds. This allows credential stuffing to piggyback on the integrity guarantees of Hmac Signatures, using legitimate signed requests to test stolen credentials against the API.

The risk is compounded when the API endpoint exposes account enumeration or inconsistent error timing. An attacker can infer whether a signed request with a known username resulted in an authentication success or failure based on response differences, even when the Hmac verification passes. Without layered defenses such as IP reputation, device fingerprinting, or adaptive step-up challenges, the combination of Hmac Signatures and weak per-request binding can make Restify APIs susceptible to high-volume credential stuffing campaigns that bypass signature-based integrity checks.

To harden Restify APIs using Hmac Signatures against credential stuffing and replay, bind the signature to a per-request, monotonic nonce and a tight timestamp window, and enforce strict replay protection. The following examples illustrate a more secure approach.

1. Include user context and a monotonic nonce in the signature

Ensure the signed payload includes the user identifier (or API key ID) and a nonce that is never reused. Store processed nonces for a bounded period and reject any request with a seen nonce.

// server.js — Restify service with secure Hmac signing
const restify = require('restify');
const crypto = require('crypto');

const server = restify.createServer();

// In-memory nonce cache with TTL (use Redis in production)
const seenNonces = new Map();
const NONCE_TTL_MS = 300_000; // 5 minutes

function cleanupExpiredNonces() {
  const now = Date.now();
  for (const [key, timestamp] of seenNonces.entries()) {
    if (now - timestamp > NONCE_TTL_MS) seenNonces.delete(key);
  }
}
setInterval(cleanupExpiredNonces, 60_000);

function verifyHmac(req, res, next) {
  const { 'x-api-key': apiKey, 'x-timestamp': ts, 'x-nonce': nonce, 'x-signature': signature } = req.headers;
  if (!apiKey || !ts || !nonce || !signature) return res.send(401, { code: 'missing_auth' });

  // Reject old timestamps to prevent replay
  const tsMs = parseInt(ts, 10);
  const nowMs = Date.now();
  const ALLOWED_CLOCK_SKEW_MS = 30_000;
  if (Math.abs(nowMs - tsMs) > ALLOWED_CLOCK_SKEW_MS) {
    return res.send(401, { code: 'stale_timestamp' });
  }

  // Reject reused nonces
  if (seenNonces.has(nonce)) {
    return res.send(401, { code: 'replayed_nonce' });
  }

  const method = req.method.toUpperCase();
  const path = req.path;
  const body = req.body && Object.keys(req.body).length ? JSON.stringify(req.body) : '';
  const payload = `${method}
${path}
${ts}
${nonce}
${body}`;

  const expected = crypto.createHmac('sha256', Buffer.from(apiKey, 'base64'))
                         .update(payload)
                         .digest('hex');

  seenNonces.set(nonce, nowMs);

  if (!crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expected, 'hex'))) {
    return res.send(401, { code: 'invalid_signature' });
  }

  // Optionally bind to user by validating apiKey against a user mapping here
  return next();
}

server.pre(restify.plugins.preValidation(verifyHmac));

2. Enforce strict rate limiting and incremental protections

Combine Hmac verification with per-identity rate limits and anomaly detection to mitigate credential stuffing. Even with valid signatures, limit requests per API key/user and apply stricter limits on suspicious patterns.

// rate-limiter.js — simple token-bucket per API key
const buckets = new Map();

function allowRequest(apiKey, maxRequests = 10, windowSec = 60) {
  const now = Date.now();
  const bucket = buckets.get(apiKey) || { tokens: maxRequests, last: now };
  const elapsedSec = (now - bucket.last) / 1000;
  bucket.tokens = Math.min(maxRequests, bucket.tokens + elapsedSec * (maxRequests / windowSec));
  bucket.last = now;
  if (bucket.tokens < 1) return false;
  bucket.tokens -= 1;
  buckets.set(apiKey, bucket);
  return true;
}

// In your route handler or preValidation:
server.pre((req, res, next) => {
  const { 'x-api-key': apiKey } = req.headers;
  if (!apiKey || !allowRequest(apiKey)) {
    return res.send(429, { code: 'rate_limit_exceeded' });
  }
  return next();
});

3. Use HTTPS and require additional context for sensitive operations

Ensure all endpoints are served over TLS to prevent passive capture. For critical flows, require a second factor or a step-up challenge rather than relying solely on Hmac-signed requests derived from static credentials.

// Enforce HTTPS in Restify
server.use(restify.plugins.secureHeaders());
// Example: require re-authentication for sensitive mutations
function requireReauth(req, res, next) {
  if (req.method === 'POST' && (req.path === '/transfer' || req.path === '/change-password')) {
    if (!req.headers['x-reauth-token']) return res.send(403, { code: 'reauth_required' });
    // validate reauth token separately
  }
  return next();
}
server.pre(restify.plugins.preValidation(requireReauth));