Null Pointer Dereference in Express with Bearer Tokens

A null pointer dereference in an Express API occurs when code attempts to read or call a property on a variable that is null or undefined. When Bearer token handling is involved, this typically arises from assuming the presence or shape of authentication-related objects without validating them first. For example, if an endpoint relies on req.user or a parsed token payload being available, but the token is missing, malformed, or the authentication middleware failed to attach the user, any subsequent access like req.user.id or req.user.scope can throw a runtime null pointer dereference. This is common when token extraction, verification, and enrichment are not defensively guarded. The vulnerability is exposed because an attacker can simply omit the Authorization header, provide an empty token, or supply a token that fails verification, triggering server-side errors that may leak stack traces or internal behavior. In the context of the 12 security checks run by middleBrick, this falls under Input Validation and Authentication: unchecked or missing tokens represent invalid input that leads to unstable runtime states. A missing or invalid Bearer token should never be assumed valid; the server must handle absence gracefully to avoid crashes or information exposure. Using middleBrick’s unauthenticated scan, such risky patterns can be detected before they reach production, as the scanner probes endpoints without credentials and reports findings tied to authentication and input validation.

To prevent null pointer dereference when working with Bearer tokens in Express, always validate the presence and structure of the token and its decoded payload before accessing nested properties. Below are concrete, safe patterns with working code examples.

1. Defensive token presence checks

Ensure the Authorization header exists and follows the Bearer scheme before attempting to decode or use it.

function ensureBearerToken(req, res, next) {
  const authHeader = req.headers['authorization'];
  if (!authHeader || typeof authHeader !== 'string') {
    return res.status(401).json({ error: 'Unauthorized: missing authorization header' });
  }
  const parts = authHeader.split(' ');
  if (parts.length !== 2 || parts[0].toLowerCase() !== 'bearer') {
    return res.status(401).json({ error: 'Unauthorized: invalid authorization format' });
  }
  const token = parts[1];
  if (!token || !token.trim()) {
    return res.status(401).json({ error: 'Unauthorized: empty token' });
  }
  next();
}

app.get('/profile', ensureBearerToken, (req, res) => {
  // token presence is guaranteed here
  res.json({ message: 'profile accessible' });
});

2. Safe decoding and payload validation

After verifying the token string, decode it and confirm the payload contains required fields before accessing them.

const jwt = require('jsonwebtoken');

function validateTokenPayload(req, res, next) {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  if (!token) {
    return res.status(401).json({ error: 'Unauthorized: missing token' });
  }
  try {
    const payload = jwt.verify(token, process.env.JWT_SECRET);
    // Ensure required claims exist
    if (!payload || typeof payload !== 'object' || !payload.sub) {
      return res.status(401).json({ error: 'Unauthorized: invalid token payload' });
    }
    req.user = { id: payload.sub, scope: payload.scope || 'user' };
    next();
  } catch (err) {
    return res.status(401).json({ error: 'Unauthorized: invalid token' });
  }
}

app.get('/admin', validateTokenPayload, (req, res) => {
  // req.user is guaranteed to have id and scope
  if (req.user.scope !== 'admin') {
    return res.status(403).json({ error: 'Forbidden: insufficient scope' });
  }
  res.json({ message: 'admin access granted' });
});

3. Centralized error handling to avoid null pointer crashes

Even with checks, unexpected null values can surface. Use a centralized error handler to avoid crashes and prevent information leakage.

app.use((err, req, res, next) => {
  if (err && err.name === 'TypeError' && err.message.includes('cannot read')) {
    // Log for internal diagnostics; do not expose internals
    console.error('Null pointer risk caught:', err);
    return res.status(500).json({ error: 'Internal server error' });
  }
  next(err);
});

These patterns ensure that missing or malformed Bearer tokens never lead to null pointer dereference. They align with authentication best practices and are the kind of input validation and authentication findings that middleBrick reports, helping you identify and remediate such issues before attackers can exploit them.