Missing Authentication in Adonisjs with Basic Auth

Ads in AdonisJS often rely on packages such as @adonisjs/basic-auth to enforce HTTP Basic Authentication. When the required middleware is omitted or misconfigured, the endpoint becomes unauthenticated from an API security perspective. middleBrick flags this as Missing Authentication because the route accepts requests without presenting valid credentials, exposing functionality that should be protected.

Consider a typical route definition that intends to use Basic Auth but accidentally skips the middleware registration in start/routes.ts:

import Route from '@ioc:Adonis/Core/Route'

// Intended to be protected, but middleware is not referenced
Route.get('/internal/metrics', 'MetricsController.show')

If the application expects Basic Auth via a package like @adonisjs/basic-auth but the route does not include the corresponding middleware (e.g., auth:basic), an attacker can call the endpoint without credentials and obtain sensitive operational data. This aligns with the BOLA/IDOR and Authentication checks in middleBrick’s 12 parallel security checks, because the vulnerability is about missing access control rather than a flaw in the Basic Auth implementation itself.

During a scan, middleBrick tests unauthenticated access and checks whether responses differ when credentials are provided. A missing authentication flaw is indicated when unauthenticated requests succeed with the same data as authenticated ones, or when the server does not challenge with a 401 when credentials are omitted. Because Basic Auth sends credentials in base64-encoded form without encryption unless used over TLS, missing authentication compounds the risk by exposing secrets in transit if encryption is also absent.

In a real-world scenario, an unauthenticated endpoint might return user lists, configuration, or tokens. middleBrick’s detection includes analyzing whether the response contains sensitive data, which could map to compliance frameworks such as OWASP API Top 10 (A01: Broken Access Control) and SOC 2 controls. The scanner does not fix the route but provides findings with remediation guidance, emphasizing that developers must explicitly apply the appropriate auth middleware to each route that requires protection.

To remediate missing authentication with Basic Auth in AdonisJS, explicitly register the Basic Auth middleware on routes that must be protected. Ensure that the auth provider is properly configured and that TLS is enforced in production to prevent credentials from being transmitted in clear text.

1) Define a route with the Basic Auth middleware in start/routes.ts:

import Route from '@ioc:Adonis/Core/Route'

Route.get('/internal/metrics', 'MetricsController.show')
  .middleware(['auth:basic'])

2) Configure the Basic Auth provider in config/auth.ts to validate users against a database or a static list. For example, using the database provider:

import { BasicAuthUserProviderConfig } from '@ioc:Adonis/Addons/BasicAuth'

const basicAuthProvider: BasicAuthUserProviderConfig = {
  driver: 'database',
  table: 'basic_auth_users',
  usernameField: 'username',
  passwordField: 'password_hash',
}

export default {
  providers: {
    basicAuth: basicAuthProvider,
  },
}

3) Use a controller that expects the authenticated user and returns protected data only when credentials are valid:

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default class MetricsController {
  public async show({ auth }: HttpContextContract) {
    const user = auth.getUserOrFail()
    // Fetch and return protected metrics for the authenticated user
    return { user: user.username, metrics: { requests: 1234 } }
  }
}

4) Enforce TLS in production by configuring your server (e.g., reverse proxy or Node.js HTTPS) to terminate TLS and by setting FORCE_HTTPS=true in environment variables. Basic Auth credentials are base64-encoded, not encrypted; without TLS, missing authentication effectively becomes credential exposure.

middleBrick’s scan will verify that the endpoint returns a 401 challenge when credentials are absent and that protected data is not returned without valid Basic Auth headers. By combining correct middleware registration, secure credential storage, and TLS, you address the missing authentication finding and reduce the risk of unauthorized access mapped to frameworks like OWASP API Top 10 and GDPR data protection requirements.