Credential Stuffing in Strapi (Typescript)

Credential stuffing is a brute-force technique where attackers use previously breached username and password pairs to gain unauthorized access. Strapi, a Node.js headless CMS often used with Typescript, can be susceptible when authentication controls are weak or misconfigured. When Strapi’s default authentication mechanisms are relied upon without additional protections, endpoints such as the local provider login route can become targets for automated credential stuffing campaigns.

In a Typescript-based Strapi project, developers may inadvertently expose attack surfaces through permissive CORS settings, missing account lockout logic, or lack of rate limiting on authentication endpoints. For example, if the auth/local endpoint is accessible unauthenticated and does not enforce strict request throttling, attackers can run scripts that submit large volumes of credential pairs. Because Strapi’s user data model is often extended with custom Typescript entities and services, developers might also introduce custom logic that does not adequately validate or throttle incoming authentication requests.

During a black-box scan, middleBrick tests authentication endpoints without credentials, simulating credential stuffing patterns to identify weaknesses such as missing multi-factor authentication, weak password policies, or insufficient monitoring for repeated failed logins. The scan evaluates whether Strapi’s authentication layer, when used with Typescript extensions, provides adequate protection against high-volume login attempts, and highlights risks like exposed admin panels or predictable user identifiers that facilitate enumeration.

To mitigate credential stuffing in Strapi with Typescript, implement strong authentication controls and request-level protections. Use environment variables for secrets, enforce strong password policies, and ensure consistent validation across your Typescript controllers and services.

Example: Rate-limiting and validation in a custom authentication controller

Instead of relying solely on Strapi’s default auth provider, create a Typescript controller that adds explicit checks. The following example shows a custom AuthController with rate limiting using an in-memory store (replace with Redis or similar in production) and strict input validation before delegating to Strapi’s service layer.

import { Request, Response } from 'express';
import { sanitizeEntity } from 'strapi-utils';

// Simple in-memory rate limiter (use Redis in production)
const loginAttempts = new Map();
const RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000; // 15 minutes
const MAX_ATTEMPTS = 5;

export default {
  async customLogin(ctx: { request: { body: { identifier: string; password: string } }; state: any; }): Promise<void> {
    const { identifier, password } = ctx.request.body;
    const now = Date.now();
    const key = identifier.toLowerCase().trim();

    const record = loginAttempts.get(key);
    if (record && now - record.lastAttempt < RATE_LIMIT_WINDOW_MS) {
      if (record.count >= MAX_ATTEMPTS) {
        ctx.status = 429;
        ctx.body = { error: 'Too many attempts. Try again later.' };
        return;
      }
    }

    // Validate input constraints
    if (!identifier || !password || password.length < 12) {
      ctx.status = 400;
      ctx.body = { error: 'Invalid credentials.' };
      return;
    }

    // Delegate to Strapi’s user service for password comparison
    const user = await strapi.entityService.findOne('api::user.user', { filters: { email: identifier } });
    if (!user) {
      // Avoid revealing user existence
      await fakeHash(password);
      ctx.status = 401;
      ctx.body = { error: 'Invalid credentials.' };
      return;
    }

    const valid = await strapi.plugins['users-permissions'].services.user.validate(password, user.password);
    if (!valid) {
      // Update rate limiter on failure
      loginAttempts.set(key, { count: (record?.count ?? 0) + 1, lastAttempt: now });
      ctx.status = 401;
      ctx.body = { error: 'Invalid credentials.' };
      return;
    }

    // Reset on success
    loginAttempts.delete(key);
    const sanitizedUser = sanitizeEntity(user, { model: strapi.query('api::user.user').model });
    ctx.body = { user: sanitizedUser };
  },
};

async function fakeHash(input: string): Promise<void> {
  // Constant-time dummy hash to prevent timing leaks
  await new Promise((res) => setTimeout(res, 50 + Math.floor(Math.random() * 100)));
}

Additionally, enable and configure Strapi’s built-in rate limiting and account lockout features where available, and enforce password complexity rules at the schema level. For Typescript developers, ensure that custom validation logic uses strict type checks and avoids unsafe type assertions that could bypass security checks.

Protecting the admin panel

Restrict access to the admin panel by IP allowlisting and enforcing strong session policies. In your Strapi configuration, set admin.server.url to a non-standard path and require MFA for admin users. Monitor authentication logs for repeated failures that indicate credential stuffing attempts.