Credential Stuffing in Sails with Hmac Signatures

Credential stuffing is an automated attack in which lists of breached username and password pairs are used to gain unauthorized access to user accounts. Sails is a Node.js web framework that can be used to build APIs; when authentication is implemented using Hmac Signatures without additional protections, the API may be exposed to credential stuffing despite the use of cryptographic signatures.

Hmac Signatures typically protect the integrity of requests by signing a canonical representation of the request (method, path, headers, and body) with a secret key. In Sails, a developer might sign a payload containing a username and password and send it to an authentication endpoint. If the endpoint accepts the Hmac-signed request without first validating credentials against rate limits or other abuse controls, attackers can replay a high volume of signed requests using credential stuffing lists. The signature itself is valid for each pair because the secret key is static and the signing process does not inherently bind the request to a single authentication attempt.

Another exposure arises when the Hmac signature is computed over user-supplied credentials that are then reused across requests. For example, if the client sends username and password inside the signed payload and the server uses those same values to look up a user, an attacker can iterate through credential pairs while keeping the signature generation logic intact on the client. Without per-request nonces or timestamps, replay is possible within the signature validity window. Moreover, if the authentication route does not enforce strict input validation, attackers may attempt injection or enumeration via malformed credentials, and the Hmac verification may still succeed, allowing the request to proceed.

Because middleBrick scans the unauthenticated attack surface, it can detect endpoints that accept Hmac-signed authentication requests without complementary protections such as rate limiting, request replay prevention, or multi-factor controls. Findings will highlight the absence of these safeguards and provide remediation guidance to reduce the risk of automated credential stuffing against Sails services that rely on Hmac Signatures.

To mitigate credential stuffing when using Hmac Signatures in Sails, implement replay protection, strict input validation, and rate limiting. The following examples assume you are using a middleware approach to verify Hmac signatures before allowing authentication logic to proceed.

1. Use a timestamp and nonce to prevent replay:

// In api/hooks/hmac-verify/index.js
const crypto = require('crypto');

module.exports.verifyHmac = (req, res, next) => {
  const receivedSignature = req.headers['x-signature'];
  const timestamp = req.headers['x-timestamp'];
  const nonce = req.headers['x-nonce'];
  const body = req.body;

  if (!receivedSignature || !timestamp || !nonce) {
    return res.badRequest('Missing signature, timestamp, or nonce');
  }

  // Reject old timestamps (e.g., 5 minutes)
  const now = Date.now();
  const requestTime = parseInt(timestamp, 10);
  if (Math.abs(now - requestTime) > 300000) {
    return res.forbidden('Request expired');
  }

  // Ensure nonce has not been used before (use a fast cache or DB)
  if (wasSeen(nonce)) {
    return res.forbidden('Replay detected');
  }

  const sortedKeys = Object.keys(body).sort();
  const canonical = sortedKeys.map(k => `${k}:${body[k]}`).join('\n');
  const expected = crypto.createHmac('sha256', process.env.HMAC_SECRET)
                         .update(canonical)
                         .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(receivedSignature))) {
    return res.forbidden('Invalid signature');
  }

  markSeen(nonce);
  return next();
};

2. Apply the middleware to your authentication route and enforce strong password policies:

// In api/controllers/AuthController.js
const bcrypt = require('bcrypt');
const rateLimit = require('some-rate-limiter');

module.exports.login = async (req, res) => {
  const { username, password } = req.body;

  // Input validation
  if (!username || !password || typeof username !== 'string' || typeof password !== 'string') {
    return res.badRequest('Invalid input');
  }

  // Rate limiting per username or IP
  if (!rateLimit.check(req, username)) {
    return res.tooManyRequests('Too many attempts');
  }

  const user = await User.findOne({ username });
  if (!user) {
    // Perform a dummy hash to reduce timing differences
    await bcrypt.hash(password, 10);
    return res.unauthorized('Invalid credentials');
  }

  const match = await bcrypt.compare(password, user.passwordHash);
  if (!match) {
    return res.unauthorized('Invalid credentials');
  }

  // Issue token or session
  const token = jwt.sign({ id: user.id }, process.env.JWT_SECRET, { expiresIn: '1h' });
  return res.ok({ token });
};

3. Enforce global rate limiting and monitor for bulk requests:

// config/middleware.js
const rateLimit = require('express-rate-limit');

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // limit each IP to 5 authentication attempts per window
  keyGenerator: (req) => {
    return req.body.username || req.ip;
  },
  handler: (req, res) => {
    return res.status(429).send('Too many requests');
  }
});

module.exports.rates = {
  auth: authLimiter,
};

By combining Hmac signature verification with replay-resistant headers, strict input checks, and rate limiting, Sails APIs can resist credential stuffing while still using cryptographic request signing. middleBrick can identify endpoints that lack these protections and report findings aligned with frameworks such as OWASP API Top 10.