Man In The Middle in Feathersjs with Dynamodb

When a FeathersJS application connects to DynamoDB without enforcing transport security, a Man In The Middle (MitM) can intercept or alter requests and responses. This risk exists because DynamoDB endpoints typically require TLS; if the client omits HTTPS or does not validate server certificates, an attacker on the same network can position themselves between the service and DynamoDB.

FeathersJS does not inherently enforce TLS for external data sources. If you initialize the DynamoDB client with an HTTP endpoint or allow environment variables to specify a non-TLS URL, credentials, table names, and potentially unencrypted query results can be observed or modified in transit. This is especially relevant in local development or in containerized environments where networking is misconfigured or shared.

Additionally, if your FeathersJS service calls downstream APIs or uses AWS SDK clients that rely on default credential providers, an attacker who can intercept traffic might capture temporary tokens or inject falsified responses. For example, without proper TLS and hostname verification, a malicious actor could redirect DynamoDB API calls to a rogue endpoint that mimics the table structure, leading to data disclosure or tampering.

Even when using the official AWS SDK for JavaScript with DynamoDB, if the configuration skips signature validation or uses an incorrect region endpoint that does not enforce HTTPS, the communication channel remains vulnerable. Attack patterns such as SSL stripping or malicious proxying become feasible when transport-layer controls are absent or misconfigured.

To protect against MitM when using DynamoDB in FeathersJS, enforce TLS at the SDK and application level, validate endpoints, and avoid insecure credential or configuration sources.

1. Enforce HTTPS and correct endpoint configuration

Always configure the AWS SDK to use HTTPS and explicitly set the correct region and endpoint. Do not rely on defaults that might resolve to HTTP in certain environments.

const { DynamoDB } = require("aws-sdk");

const dynamodb = new DynamoDB({
  region: "us-east-1",
  endpoint: "https://dynamodb.us-east-1.amazonaws.com", // explicit HTTPS
  sslEnabled: true,
  httpOptions: {
    rejectUnauthorized: true // enforce certificate validation
  }
});

module.exports = dynamodb;

2. Secure FeathersJS service communication with DynamoDB

In your FeathersJS service file, use the secure DynamoDB client and avoid constructing URLs from untrusted input. Ensure that table names are validated against an allowlist to prevent injection or redirection to malicious tables.

const dynamodb = require("../lib/dynamodb");
const { marshall, unmarshall } = require("@aws-sdk/util-dynamodb");

class NotesService {
  async find(params) {
    const params = {
      TableName: "Notes", // validate this name in your app config
      KeyConditionExpression: "userId = :uid",
      ExpressionAttributeValues: marshall({ ":uid": params.params.query.userId })
    };
    const data = await dynamodb.query(params).promise();
    return data.Items.map(unmarshall);
  }

  async get(id, params) {
    const params = {
      TableName: "Notes",
      Key: marshall({ id })
    };
    const data = await dynamodb.get(params).promise();
    if (!data.Item) throw new Error("Not found");
    return unmarshall(data.Item);
  }
}

module.exports = function () {
  const app = this;
  app.use("/notes", new NotesService());
};

3. Validate and sanitize inputs to prevent tampering

Ensure that any user-controlled values used in DynamoDB requests (such as table names or key attributes) are validated. This prevents an attacker from manipulating the request to point to a different table or endpoint.

const allowedTables = new Set(["Notes", "Users", "Settings"]);

function validateTable(tableName) {
  if (!allowedTables.has(tableName)) {
    throw new Error("Invalid table name");
  }
  return tableName;
}

// Usage inside a service method
const tableName = validateTable(userSuppliedTableName);

4. Environment and runtime hardening

Do not pass credentials via environment variables that could be read by unauthorized processes. Use IAM roles or instance profiles where possible, and ensure that your container or deployment configuration does not expose HTTP ports for DynamoDB communication.

Tools like middleBrick can help detect whether your API endpoints or underlying configurations inadvertently allow insecure communication paths. By scanning your API definitions and runtime behavior, middleBrick can surface findings related to transport security, helping you verify that MitM risks are addressed.