Dictionary Attack in Feathersjs with Basic Auth

A dictionary attack becomes feasible in a Feathersjs application using Basic Authentication when authentication relies only on username and password checks without supplemental protections. Feathersjs does not enforce account lockout, rate limiting, or incremental delays on failed attempts by default, so an attacker can systematically submit credentials from a wordlist against the login endpoint. Because Basic Authentication sends credentials in an encoded (not encrypted) header on each request, interception is possible without TLS. If the transport lacks strong encryption, credentials can be captured. Even with TLS, the absence of rate limiting or progressive delays allows rapid probing. The framework’s typical setup exposes a service (e.g., an authentication service) that accepts a payload containing email and password. Without additional guards, each guess results in a distinct server-side validation attempt, leaving the application susceptible to online password guessing. Attackers commonly target Feathersjs APIs because developers mistakenly assume Basic Auth is sufficient when combined with HTTPS, overlooking the need for throttling, multi-factor options, or suspicious activity detection.

To mitigate dictionary attacks, combine transport security with application-level controls. Enforce HTTPS to protect credentials in transit and add rate limiting to the authentication route. Below is a concrete example of a Feathersjs authentication service with protective measures.

Secure Feathersjs Authentication Service Example

const feathers = require('@feathersjs/feathers');
const express = require('@feathersjs/express');
const basicAuth = require('feathers-authentication-local');
const rateLimit = require('express-rate-limit');

const app = feathers();

// Configure rate limiting for authentication endpoints
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // Limit each IP to 5 login attempts per windowMs
  standardHeaders: true,
  legacyHeaders: false,
  message: {
    code: 429,
    message: 'Too many login attempts. Please try again later.'
  }
});

// Apply rate limiting to the authentication path
app.use('/authentication/login', express.json(), authLimiter);

// Local authentication setup with secure password handling
app.configure(basicAuth({
  entity: 'user',
  service: 'users',
  usernameField: 'email',
  passwordField: 'password',
  authStrategies: ['local'],
  // Enforce strong password hashing (bcrypt is default in feathers-authentication-local)
  // Ensure your user model stores only the hash, never plain text
}));

// Example login route that leverages the configured strategy
app.post('/authentication/login', async (context) => {
  const { email, password } = context.data;
  const userService = context.app.service('users');

  // The local strategy validates credentials against the user model
  // Additional checks (e.g., account status, MFA) can be added here
  const user = await userService.find({ query: { email } });
  if (!user.data || user.data.length === 0) {
    throw new Error('Invalid credentials');
  }
  // Further validation and token issuance handled by feathers-authentication-local
  return context;
});

app.use('/', app);

Key remediation points:

• Rate Limiting: Apply an express-rateLimit middleware to the login path to restrict attempts per IP address and user agent.
• Transport Security: Enforce HTTPS across the application, especially on endpoints handling Basic Auth headers.
• Credential Storage: Ensure passwords are stored using a strong adaptive hash (e.g., bcrypt). The feathers-authentication-local package handles hashing by default; verify your user model’s password field stores only the hash.
• Account Policies: Consider implementing temporary lockouts after repeated failures or introducing CAPTCHA challenges for suspicious patterns.

These steps reduce the feasibility of dictionary attacks by slowing down attempts and protecting credentials, while still allowing legitimate access through properly validated Basic Auth credentials.