Cryptographic Failures in Express with Basic Auth

Basic Authentication in Express transmits credentials in an HTTP header that is base64-encoded, not encrypted. If the connection is not protected by TLS, the encoded token is trivial to decode and exposes a username and password in transit. This is a Cryptographic Failures category finding under the 12 parallel security checks because the confidentiality and integrity of credentials are not adequately protected.

When combined with an unauthenticated or misconfigured endpoint, Basic Auth in Express can leak credentials to network observers via man-in-the-middle attacks or insecure storage on the server side. For example, middleware that logs headers or passes authorization data to downstream services without enforcing HTTPS increases the risk of exposure. Because middleBrick performs unauthenticated, black-box scanning, it can detect whether an endpoint accepts Basic Auth over non-TLS channels and whether credentials are transmitted in plaintext or weakly protected channels.

During a scan, middleBrick tests whether the server inadvertently exposes credentials through insecure transport or weak cryptographic practices. Findings in this category include missing HTTP Strict Transport Security (HSTS), use of non-TLS transports for authentication, or improper handling of secure cookies. These issues are mapped to the OWASP API Top 10 cryptographic weaknesses and can be tied to compliance frameworks such as PCI-DSS and GDPR. Even when TLS is present, poor cipher choices or outdated protocols can still be flagged as Cryptographic Failures if they do not meet current security standards.

In an Express application, developers sometimes assume that Base64 provides security, which is a dangerous misconception. Base64 is easily reversible and offers zero protection without encryption. middleBrick’s checks include verifying whether the server rejects credentials sent over non-secure channels and whether the application properly redirects HTTP to HTTPS before any authentication logic is applied.

Additionally, storing Basic Auth credentials insecurely on the server — for example, in logs, configuration files, or debug output — can lead to data exposure. The scanner tests for indicators of such exposure by analyzing runtime behavior and response headers. This helps identify whether sensitive information related to authentication is being leaked, which is a direct violation of secure cryptographic handling.

To remediate Cryptographic Failures when using Basic Auth in Express, enforce HTTPS for all traffic and avoid relying on Base64 for secrecy. Always use TLS to protect credentials in transit and validate the protocol before processing authentication.

const https = require('https');
const fs = require('fs');
const express = require('express');
const authMiddleware = require('basic-auth');

const app = express();

// Enforce HTTPS in production
app.use((req, res, next) => {
  if (req.headers['x-forwarded-proto'] !== 'https') {
    return res.redirect(301, `https://${req.headers.host}${req.url}`);
  }
  next();
});

// Basic Auth handler with secure checks
app.get('/api/secure', (req, res) => {
  const user = authMiddleware(req);

  if (!user || user.name !== process.env.AUTH_USER || user.pass !== process.env.AUTH_PASS) {
    res.set('WWW-Authenticate', 'Basic realm="example"');
    return res.status(401).send('Authentication required');
  }

  res.json({ message: 'Authenticated securely' });
});

const server = https.createServer({
  key: fs.readFileSync('/path/to/private.key'),
  cert: fs.readFileSync('/path/to/certificate.crt')
}, app);

server.listen(443);

This example shows how to enforce HTTPS before any authentication logic. The middleware redirects HTTP requests to HTTPS, ensuring credentials are never transmitted in cleartext. Using environment variables for credentials prevents accidental exposure in source code or logs.

Another important practice is to avoid logging authorization headers. Ensure your logging configuration excludes sensitive headers:

app.use((req, res, next) => {
  // Avoid logging sensitive headers
  if (req.headers.authorization) {
    req.headers.authorization = '[Filtered]';
  }
  next();
});

For production deployments, combine these patterns with strong cipher suites and HSTS headers. Use tools like middleBrick’s scans to verify that no endpoints accept Basic Auth over insecure channels and that remediation steps are correctly applied.