Man In The Middle in Adonisjs with Basic Auth

When an AdonisJS application uses HTTP Basic Authentication over unencrypted HTTP, the credentials are encoded but not encrypted. A Man In The Middle (MitM) can intercept the request on the network, decode the Base64 string, and obtain the username and password in cleartext. This is not an AdonisJS-specific flaw; it is a property of Basic Auth over insecure channels. AdonisJS may receive the credentials via request.auth() or header parsing, but if the transport is not protected, the secret is exposed before it ever reaches application code. Attackers may perform passive interception on shared networks or active interception via compromised routers or malicious proxies. AdonisJS itself does not introduce additional weakness here, but the framework’s convenience in handling auth headers can lead developers to underestimate the need for transport-layer encryption. Without TLS, session tokens or cookies issued after Basic Auth login are also at risk of interception, enabling session hijacking. Even if AdonisJS sets secure, HttpOnly cookies, the initial authentication step remains vulnerable when sent in the clear. The combination of Basic Auth’s static credential transmission and missing HTTPS creates a classic MitM attack surface. MiddleBrick scans detect this by checking whether authentication occurs over non-encrypted HTTP and flagging missing transport protections alongside authentication mechanisms.

Remediation centers on enforcing HTTPS and avoiding the storage or transmission of credentials in cleartext. AdonisJS should never be deployed with Basic Auth over plain HTTP. Use TLS termination at the load balancer or reverse proxy, and ensure AdonisJS is only reachable via HTTPS. When using Basic Auth, transmit credentials only over encrypted connections and avoid embedding them in URLs or logs.

Example of insecure route handling with Basic Auth (to avoid):

import Route from '@ioc:Adonis/Core/Route'

Route.get('/api/me', async ({ request }) => {
  const user = request.auth()
  return user
})

Example of secure configuration using middleware to enforce HTTPS and validate credentials without exposing secrets:

import Route from '@ioc:Adonis/Core/Route'
import { schema } from '@ioc:Adonis/Core/Validator'
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

// Enforce HTTPS in production via middleware (conceptual)
Route.group(() => {
  Route.get('/api/me', async ({ request }: HttpContextContract) => {
    // Ensure request is secure
    if (!request.secure) {
      throw new Error('HTTPS required')
    }
    const user = request.auth()
    return user
  }).middleware(['https'])
})

// HTTPS enforcement middleware example (simplified)
// server/middleware/https.ts
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default async function https({ request, response, proceed }: HttpContextContract) {
  if (process.env.NODE_ENV === 'production' && !request.secure) {
    response.status(403).send('HTTPS required')
    return
  }
  return proceed()
}

For production, terminate TLS at the proxy and configure AdonisJS to trust the proxy headers. Use environment variables for configuration rather than hardcoding credentials. MiddleBrick’s scans validate that authentication endpoints are served over encrypted channels and that no credentials are exposed in URLs or error messages.