Identification Failures in Express with Hmac Signatures

Identification failures occur when an API cannot reliably determine the identity of the caller. In Express, using Hmac signatures for request authentication can introduce identification gaps if the implementation does not consistently validate the signature or map it to a specific principal. When a server-side route relies on an Hmac signature without verifying the associated identity (e.g., which client key was used), it may incorrectly attribute the request to an implicit or default identity, leading to authorization decisions based on incomplete or missing identification.

Hmac signatures themselves are a strong integrity mechanism, but they do not inherently carry identity. If the Express application uses the signature only to verify that the payload has not been altered, and skips looking up the key owner, the request may be processed as unauthenticated or as the wrong user. For example, an endpoint that checks hmacIsValid but does not check which service account or API key corresponds to the provided key ID can allow one client’s requests to be handled as another’s. This is an identification failure because the subject making the request is not correctly resolved before authorization checks.

The combination of Express routing and Hmac signature validation exacerbates this when developers centralize signature verification in a middleware but do not propagate the resolved identity to downstream route handlers or attach it to the request object. If the verification middleware sets only a boolean flag (valid/invalid) and omits attaching a normalized identity (such as a client ID or user ID), later handlers have no reliable way to identify the caller. This can lead to logic such as if (request.user) allow() incorrectly passing when the signature is valid but the identity is unknown, or it can cause the application to default to a guest context and expose data that should be isolated per client.

Real-world attack patterns include scenarios where an attacker sends valid Hmac-signed requests using a stolen or low-privilege key, and the server fails to map the key to a scoped identity, inadvertently granting broader access. Another pattern arises when endpoints that should be scoped to a particular resource (e.g., a tenant or organization) do not tie the key or key ID to that scope, enabling horizontal privilege escalation across unrelated resources. These identification failures do not break integrity but break the link between identity and permissions, which is central to BOLA/IDOR and authorization flaws covered in the 12 checks run by middleBrick.

To detect these issues, scanning should verify that Hmac verification is paired with explicit identity resolution and that the resolved identity is used in authorization checks rather than relying on the mere presence of a valid signature. middleBrick checks whether route handlers reference a resolved identity on the request object and whether key-to-identity mappings are validated server-side, highlighting gaps where identification is incomplete.

Remediation focuses on ensuring that after Hmac signature validation, the server resolves and attaches a concrete identity to the request, and that downstream handlers use that identity for authorization. Below are concrete Express examples that demonstrate insecure patterns and their fixes.

Insecure example: signature check without identity resolution

const crypto = require('crypto');

const SHARED_SECRET = process.env.SHARED_SECRET;

function verifyHmac(req, res, next) {
  const { xKeyId, signature } = req.headers;
  const payload = JSON.stringify(req.body);
  const expected = crypto.createHmac('sha256', SHARED_SECRET)
                         .update(payload)
                         .digest('hex');
  if (signature !== expected) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  // Missing: resolve xKeyId to a client identity and attach to req
  next();
}

app.post('/data', verifyHmac, (req, res) => {
  // Dangerous: no identity-based scoping
  res.json({ data: getTenantData() });
});

Secure example: resolve identity and attach to request

const crypto = require('crypto');

const SHARED_SECRET = process.env.SHARED_SECRET;

// In-memory key store for example; use a secure database in production
const keyStore = {
  'key-abc123': { clientId: 'tenant-123', scope: 'tenant:123' },
  'key-xyz789': { clientId: 'tenant-456', scope: 'tenant:456' }
};

function verifyHmacAndIdentify(req, res, next) {
  const { xKeyId, signature } = req.headers;
  if (!xKeyId || !signature) {
    return res.status(401).json({ error: 'Missing key id or signature' });
  }
  const keyMeta = keyStore[xKeyId];
  if (!keyMeta) {
    return res.status(401).json({ error: 'Unknown key' });
  }
  const payload = JSON.stringify(req.body);
  const expected = crypto.createHmac('sha256', SHARED_SECRET)
                         .update(payload)
                         .digest('hex');
  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  // Attach resolved identity to the request for downstream use
  req.identity = {
    clientId: keyMeta.clientId,
    scope: keyMeta.scope,
    keyId: xKeyId
  };
  next();
}

app.post('/data', verifyHmacAndIdentify, (req, res) => {
  // Use resolved identity to scope data access
  if (!req.identity || !req.identity.scope.startsWith('tenant:')) {
    return res.status(403).json({ error: 'Insufficient scope' });
  }
  const tenantId = req.identity.scope.split(':')[1];
  const data = getTenantDataFor(tenantId);
  res.json({ data });
});

Additional best practices

• Always use crypto.timingSafeEqual for signature comparison to mitigate timing attacks.
• Never treat a valid Hmac as implicit authentication; explicitly resolve and store identity.
• Scope keys to tenants or roles and enforce scope checks in handlers or centralized authorization logic.
• Include the key ID (or a key version) in the signed payload or as a separate header to enable key rotation and audit trails.

These practices reduce identification failures by ensuring that a valid Hmac signature leads to a concrete, checked identity before any sensitive operation, aligning with secure authorization patterns expected by frameworks like OWASP API Security and compliance mappings available in higher plans such as the Pro tier with continuous monitoring and GitHub Action integration.