Null Pointer Dereference in Feathersjs with Basic Auth

A null pointer dereference in a FeathersJS service occurs when code attempts to access a property or method on a variable that is null or undefined. When Basic Authentication is used, this risk is often introduced in the authentication handler or in hooks that assume the user object or credentials are fully populated. FeathersJS does not inherently provide a user object on the params object until after a successful authentication hook runs. If a before hook or service logic executes before authentication completes and assumes params.user exists, a null pointer dereference can occur, leading to a 500 error or information disclosure.

For example, consider a FeathersJS service that checks permissions on a record by reading params.user.id. If Basic Auth fails or the hook chain does not populate params.user, this read becomes a null pointer dereference. Additionally, misconfigured Basic Auth hooks that do not properly validate the presence of credentials can pass null or incomplete user data downstream. Because the scan tests unauthenticated attack surfaces, it can trigger such code paths by sending requests without credentials, exposing the null dereference as a server-side error.

In the context of middleBrick’s 12 security checks, a null pointer dereference may be surfaced under Input Validation or Authentication findings when runtime probes cause service code to execute with missing data. This is particularly relevant when OpenAPI specs define authentication requirements but the implementation does not guard against missing or malformed Basic Auth headers, creating a discrepancy between declared and actual runtime behavior.

To remediate null pointer dereference issues when using Basic Auth in FeathersJS, ensure that user data is always validated before use. Use explicit checks for null or undefined and ensure authentication hooks always produce a consistent user object or fail safely.

Example 1: Safe Basic Auth Hook with Null Checks

const { AuthenticationError } = require('@feathersjs/errors');

module.exports = function () {
  return async context => {
    const { authorization } = context.params.headers || {};
    if (!authorization || !authorization.startsWith('Basic ')) {
      throw new AuthenticationError('Missing Basic Auth credentials');
    }

    const base64 = authorization.split(' ')[1];
    const decoded = Buffer.from(base64, 'base64').toString('utf8');
    const [username, password] = decoded.split(':');

    if (!username || !password) {
      throw new AuthenticationError('Invalid Basic Auth credentials');
    }

    // Ensure params.user is always set after successful auth
    context.params.user = {
      username,
      roles: ['user'] // assign roles as needed
    };

    return context;
  };
};

Example 2: Service Method Guarding Against Null User

class SecureItemService {
  async get(id, params) {
    // Guard against missing user
    if (!params || !params.user) {
      throw new Error('Unauthorized: user context missing');
    }

    const item = await this.Model.findById(id);
    if (!item) {
      throw new NotFound('Item not found');
    }

    // Ensure user has permission to access this item
    if (item.userId !== params.user.username) {
      throw new Forbidden('Access denied');
    }

    return item;
  }
}

Example 3: Configuring Authentication in FeathersJS with Explicit User Assignment

const authentication = require('@feathersjs/authentication');
const basic = require('@feathersjs/authentication-basic');

app.configure(authentication({
  entity: 'user',
  service: 'users',
  secret: 'superSecret'
}));

app.configure(basic());

// Ensure the basic auth hook populates params.user
app.hooks({
  before: {
    all: [],
    auth: [authentication.hooks.authenticate(['basic'])],
    // Add a hook to guarantee params.user exists for downstream services
    ensureUser: context => {
      if (context.params.authentication && context.params.authentication.strategy === 'basic') {
        if (!context.params.user) {
          context.params.user = { username: null, roles: [] };
        }
      }
      return context;
    }
  }
});

These examples demonstrate how to explicitly validate and assign user data when using Basic Auth, preventing null pointer dereferences by ensuring params.user is always defined before service logic accesses it.