Missing Authentication in Feathersjs with Jwt Tokens

FeathersJS is a framework for real-time applications that commonly uses JWT tokens for stateless authentication. When authentication is misconfigured or omitted, endpoints that should be protected become exposed. This typically occurs when service hooks or routes are defined without requiring a valid JWT, or when the JWT verification hook is conditionally bypassed. An attacker can directly call these unauthenticated service methods, invoking business logic or data access that should be restricted.

Consider a FeathersJS service for user profiles defined without authentication guards. If the service does not enforce authentication at the Feathers hook layer, an unauthenticated request can retrieve or modify records. Even when JWT is intended for protection, inconsistent usage across services or failure to apply the authentication hook to all relevant services creates a BOLA/IDOR pattern. For example, an endpoint like /users/:id may rely on JWT claims to ensure users can only access their own data; missing or incorrect hook configuration allows one user to enumerate or modify another user’s resource by guessing IDs.

Real-world risk patterns observed in testing include services that skip authentication when a query parameter or header is set, or services that trust internal network assumptions. Because FeathersJS allows flexible hook composition, omitting the authentication hook or placing it after business logic can lead to unauthenticated execution. The scanner runs unauthenticated checks against the live API surface and detects endpoints that return data without requiring valid JWTs, mapping findings to the Authentication and BOLA/IDOR categories from OWASP API Top 10.

Additionally, if JWT validation is implemented but only applied to a subset of routes, an attacker can pivot from an unauthenticated entry point to access protected data. This can be exacerbated by weak token handling, such as accepting unsigned tokens or failing to validate the issuer and audience. The scanner’s Authentication check tests whether endpoints enforce token validation, while the BOLA/IDOR check verifies that authorization aligns with resource ownership.

To secure FeathersJS services with JWT tokens, consistently apply authentication hooks and validate tokens on every service that requires protection. Use the official @feathersjs/authentication and @feathersjs/authentication-jwt packages to centralize token verification. Define an authentication hook that checks for a valid JWT and attaches the decoded payload to the request context. Then enforce this hook in your service configuration.

Below is a complete, syntactically correct example that configures JWT authentication and applies it to a FeathersJS service. This ensures that every call to the service requires a valid token and that the user ID in the token is correctly mapped for authorization checks.

// src/authentication.js
const { AuthenticationService } = require('@feathersjs/authentication');
const { JWTStrategy } = require('@feathersjs/authentication-jwt');
const { express } = require('@feathersjs/express');

const authentication = new AuthenticationService(express.app);

authentication.register('jwt', new JWTStrategy());

// Optional: customize how the payload is transformed into the user object
authentication.hooks({
  before: {
    create: [authentication.hooks.authenticate('jwt')],
    find: [authentication.hooks.authenticate('jwt')],
    get: [authentication.hooks.authenticate('jwt')],
    update: [authentication.hooks.authenticate('jwt')],
    patch: [authentication.hooks.authenticate('jwt')],
    remove: [authentication.hooks.authenticate('jwt')]
  },
  after: {
    create: [context => {
      // Example: ensure the authenticated user matches the target user ID for sensitive operations
      const { user } = context.params;
      if (context.method === 'get' && context.result && context.result.userId !== user.id) {
        throw new Error('Unauthorized');
      }
      return context;
    }]
  }
});

module.exports = authentication;

Apply this authentication service in your main app setup and configure services to use the authentication hook. The following snippet shows how to register the auth service and protect a user service so that only requests with valid JWTs can proceed.

// src/app.js
const feathers = require('@feathersjs/feathers');
const express = require('@feathsjs/express');
const authentication = require('./authentication');
const userService = require('./services/users/users.service');

const app = express(feathers());

// Register authentication service before other services
app.configure(authentication);

// Configure the user service to require authentication
app.use('/users', userService);
app.service('users').hooks({
  before: {
    all: [authentication.hooks.authenticate('jwt')],
    find: [context => {
      // Example: restrict listing to admins by inspecting decoded JWT
      const { scope } = context.params.user || {};
      if (!scope || !scope.includes('users:read')) {
        throw new Error('Forbidden: insufficient scope');
      }
      return context;
    }],
    get: [context => {
      // Enforce user-level authorization: users can only fetch their own profile
      const { id } = context.params;
      const { user } = context.params;
      if (user.userId !== id) {
        throw new Error('Forbidden: cannot access other user data');
      }
      return context;
    }],
    create: [context => {
      // Ensure required fields and validate input
      const { email } = context.data;
      if (!email) {
        throw new Error('Email is required');
      }
      return context;
    }]
  }
});

These examples illustrate how to bind JWT verification to all CRUD operations, ensuring that missing authentication is not possible for the protected service. For additional safety, combine JWT validation with explicit role- or scope-based checks in after hooks to enforce least privilege. The scanner’s Authentication, BOLA/IDOR, and Unsafe Consumption checks validate these controls by probing endpoints both with and without tokens and inspecting token handling logic.