Memory Leak in Feathersjs with Basic Auth

A memory leak in a Feathersjs service using Basic Authentication typically arises when request-scoped data, authentication state, or cached credentials are retained beyond the lifecycle of a single request. Feathers services are built on hooks and providers; if hooks attach objects (for example, a decoded user payload or a token verification result) to the context (context.params) and those objects hold references to large data structures or circular references, the garbage collector may be unable to reclaim that memory. When Basic Auth is used, the service often decodes an Authorization header on every request, and if that decoding logic or a downstream hook caches user records, roles, or tokens in a shared location, repeated authentication can gradually increase memory usage.

Additionally, if the Feathers application reuses connections (for example, a database client or an external HTTP client) without properly releasing resources after each request, or if responses include large payloads that are retained due to lingering event listeners or streams, memory can accumulate. The unauthenticated attack surface tested by middleBrick can surface this behavior by observing changes in memory-related behavior across multiple authenticated requests, contributing to findings in categories such as Unsafe Consumption and Data Exposure during a scan.

In a typical Feathers stack, a memory leak may be triggered by:

• Hooks that push user data onto a shared array or map without cleanup.
• Misconfigured service methods that return large datasets without pagination, causing large buffers to accumulate in the event loop or response stream.
• Basic Auth middleware or hooks that retain decoded user objects in contexts that are reused across requests, especially when errors bypass normal cleanup paths.

These patterns do not necessarily indicate a vulnerability in Basic Auth itself, but they show how authentication-related data can contribute to resource exhaustion when lifecycle management is incomplete.

To reduce memory pressure when using Basic Authentication in Feathers, ensure that per-request data is stored only on the request-scoped context and cleared after the request completes. Avoid attaching large objects to long-lived structures and prefer lightweight references. Below are concrete code examples for a Feathers service using Basic Auth with hooks that manage memory responsibly.

Example 1: Feathers service with Basic Auth hook that avoids retaining large data

const { AuthenticationService } = require('@feathersjs/authentication');
const { expressOauth } = require('@feathersjs/authentication-oauth');
const express = require('express');
const app = express();

app.configure(express.json());

// Basic Auth hook that decodes and attaches only necessary user identifiers
const basicAuthHook = context => {
  const authHeader = context.params.headers.authorization || '';
  if (authHeader.startsWith('Basic ')) {
    const base64 = authHeader.split(' ')[1];
    const decoded = Buffer.from(base64, 'base64').toString('utf-8');
    const [username, password] = decoded.split(':');
    // Only store minimal identifiers; avoid attaching raw credentials or large objects
    context.params.user = { username };
    // Explicitly delete sensitive fields from params if not needed downstream
    delete context.params.headers.authorization;
  }
  return context;
};

// Example service with pagination to avoid large in-memory responses
const postsService = app.service('posts');
postsService.hooks({
  before: {
    find: [basicAuthHook, context => {
      // Enforce pagination to limit payload size
      const query = context.params.query;
      query.$limit = query.$limit || 10;
      query.$skip = query.$skip || 0;
      return context;
    }]
  },
  after: {
    find: [context => {
      // Ensure large data buffers are not retained on the response object
      if (context.result && context.result.data) {
        // Process or transform data if needed, then release references
        context.result.data = context.result.data.map(item => ({
          id: item.id,
          title: item.title
        }));
      }
      return context;
    }]
  }
});

app.use('/posts', postsService);

Example 2: Explicit cleanup in a custom hook to prevent context retention

const cleanupHook = () => {
  return context => {
    // Perform any necessary transformations
    if (context.params && context.params.user) {
      // Use user data as needed
      const { username } = context.params.user;
      // Avoid storing additional metadata unless required
      context.params.userSummary = { username };
    }
    // Clear large or sensitive fields after use
    if (context.params && context.params.original) {
      delete context.params.original;
    }
    return context;
  };
};

// Apply cleanupHook after authentication hooks to ensure no residual data remains
app.service('users').hooks({
  before: {
    all: [basicAuthHook, cleanupHook()]
  },
  after: {
    all: [context => {
      // Defensive cleanup: remove temporary fields
      if (context.params && context.params.userSummary) {
        delete context.params.userSummary;
      }
      return context;
    }]
  }
});

General best practices to prevent memory growth

• Keep per-request data on context.params and avoid attaching it to global or service-level caches.
• Use pagination and streaming for large data sets; avoid sending entire collections in a single response.
• Remove sensitive fields from the context after they are used to reduce the data retained per request.
• Monitor memory usage during development and testing; while middleBrick does not perform internal analysis, observing patterns across scans can highlight anomalous resource growth.

These practices help ensure that Basic Auth flows in Feathers remain efficient and reduce the likelihood of memory accumulation without changing the authentication mechanism itself.