Missing Authentication in Express with Basic Auth

Missing Authentication in Express when Basic Auth is either omitted or incorrectly implemented exposes endpoints that should be protected. Basic Auth relies on the Authorization header containing base64(username:password). If the server does not validate the presence and correctness of that header, or if it treats an empty/missing header as authenticated, the authentication check is effectively bypassed.

In Express, a common mistake is to check only whether a header exists, rather than verifying credentials against a known user store. For example, checking req.headers.authorization for existence without decoding and validating the token grants access to anyone who sends any string in that header. Additionally, serving the same route on both HTTP and mixed HTTP/HTTPS deployments can leak credentials in transit, and failing to protect admin or sensitive routes with authentication middleware leaves the API unauthenticated for those paths.

An attacker can exploit this by sending requests without credentials or with arbitrary credentials, enumerating admin endpoints, and performing BOLA/IDOR or data exfiltration if authorization is also missing. middleBrick’s Authentication check flags routes where no valid authentication is enforced, and its BOLA/IDOR and Property Authorization checks often surface the downstream impact of missing Authentication controls.

Because middleBrick scans unauthenticated attack surfaces, it can detect whether protected routes respond without requiring valid credentials. When combined with OpenAPI/Swagger analysis (with full $ref resolution), middleBrick cross-references declared security schemes against runtime behavior to highlight inconsistencies such as missing security requirements on endpoints that should be authenticated.

To securely implement Basic Auth in Express, always parse and validate credentials on every protected route, use HTTPS to prevent credential leakage, and avoid treating missing or malformed headers as valid authentication. Below are concrete, working examples.

Secure Basic Auth middleware

Create a reusable middleware function that checks the Authorization header, decodes the base64 payload, and compares credentials against a secure store (hardcoded for example; use a database or environment variables in production).

const express = require('express');
const app = express();
const PORT = 3000;

// Example user store (use environment variables or a secure vault in production)
const USERS = {
  'admin': 'superSecretPassword123'
};

function basicAuthMiddleware(req, res, next) {
  const authHeader = req.headers['authorization'];
  if (!authHeader || !authHeader.startsWith('Basic ')) {
    res.set('WWW-Authenticate', 'Basic realm="Access"');
    return res.status(401).json({ error: 'Authentication required' });
  }

  const base64Credentials = authHeader.split(' ')[1];
  if (!base64Credentials) {
    res.set('WWW-Authenticate', 'Basic realm="Access"');
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');
  const [username, password] = credentials.split(':');

  if (!username || !password || USERS[username] !== password) {
    res.set('WWW-Authenticate', 'Basic realm="Access"');
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  // Attach user to request for downstream use (optional)
  req.user = { username };
  next();
}

// Apply middleware to protected routes
app.get('/admin', basicAuthMiddleware, (req, res) => {
  res.json({ message: 'Admin area accessed', user: req.user });
});

app.get('/public', (req, res) => {
  res.json({ message: 'Public endpoint, no auth required' });
});

app.listen(PORT, () => {
  console.log(`Server running on http://localhost:${PORT}`);
});

Using environment variables and HTTPS enforcement

Store credentials in environment variables and enforce HTTPS in production to protect the base64-encoded credentials in transit (note: Basic Auth is base64, not encrypted, so HTTPS is mandatory).

require('dotenv').config();
const https = require('https');
const fs = require('fs');
const express = require('express');
const app = express();

const USERNAME = process.env.AUTH_USER;
const PASSWORD = process.env.AUTH_PASS;

function validateBasicAuth(req, res, next) {
  const auth = req.headers['authorization'];
  if (!auth || auth !== 'Basic ' + Buffer.from(`${USERNAME}:${PASSWORD}`).toString('base64')) {
    res.set('WWW-Authenticate', 'Basic realm="API"');
    return res.status(401).json({ error: 'Unauthorized' });
  }
  next();
}

app.get('/secure', validateBasicAuth, (req, res) => {
  res.json({ status: 'ok' });
});

const server = https.createServer({
  key: fs.readFileSync('server.key'),
  cert: fs.readFileSync('server.cert')
}, app);

server.listen(8443, () => console.log('HTTPS server on 8443'));

Integration with middleBrick

Use the CLI to scan your Express endpoints from the terminal: middlebrick scan <url>. The scan will detect whether Authentication, BOLA/IDOR, and Property Authorization checks pass. If missing Authentication leads to unauthorized access, middleBrick reports findings with severity and remediation guidance, helping you tighten your routes before deployment. The Pro plan adds continuous monitoring and CI/CD integration so future changes are automatically checked.